agenttesla | hxxps://cosmeticapampa[.]com[.]ar/ptk[.]exe

Analysis

user interaction
yes
max time kernel
298s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cosmeticapampa.com.ar/ptk.exe
Sample260731-gpv9mabl4x

Score

10^/10

collection discovery agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol
ftp
Host
ftp.anmarinee.it.com
Port
21
Username
[email protected]
Password
nHacaNzaz&,rdS4n

Extracted

Family

agenttesla

Attributes

app_add_startup
false
delete_backspace
false
enable_clipboard_logger
false
enable_contacts
true
enable_cookies
true
enable_keylogger
false
enable_screen_logger
false
enable_torpanel
false
hide_file_startup
false
keylogger_interval
20
log_type
2
pc_state
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
public_ip_address_grab
true
public_user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
screen_interval
20
startup_directory_name
eXCXES
startup_env_name
appdata
startup_installation_name
eXCXES.exe
startup_reg_name
eXCXES
tor_pid
false

Signatures

Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Downloads MZ/PE file 1 IoCs

flow	pid	Process
27	4072	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
4048	ptk.exe
3656	ptk.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ptk.exe
Key opened	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ptk.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
39	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ptk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ptk.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4072	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299511713099379"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{6B656661-7645-4C75-99B6-1828B9DD6013}	msedge.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4048	ptk.exe
4048	ptk.exe
4048	ptk.exe
3656	ptk.exe
3656	ptk.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4048	ptk.exe
Token: SeDebugPrivilege	3656	ptk.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 2756	768	msedge.exe	85
PID 768 wrote to memory of 4072	768	msedge.exe	86
PID 768 wrote to memory of 4152	768	msedge.exe	87
PID 768 wrote to memory of 4152	768	msedge.exe	87
PID 768 wrote to memory of 4152	768	msedge.exe	87
PID 768 wrote to memory of 4592	768	msedge.exe	88
PID 768 wrote to memory of 4592	768	msedge.exe	88
PID 768 wrote to memory of 2508	768	msedge.exe	89
PID 768 wrote to memory of 2508	768	msedge.exe	89
PID 768 wrote to memory of 2508	768	msedge.exe	89
PID 768 wrote to memory of 3604	768	msedge.exe	90
PID 768 wrote to memory of 3604	768	msedge.exe	90
PID 768 wrote to memory of 3604	768	msedge.exe	90
PID 768 wrote to memory of 1864	768	msedge.exe	92
PID 768 wrote to memory of 1864	768	msedge.exe	92
PID 768 wrote to memory of 1864	768	msedge.exe	92
PID 768 wrote to memory of 1604	768	msedge.exe	93
PID 768 wrote to memory of 1604	768	msedge.exe	93
PID 768 wrote to memory of 1604	768	msedge.exe	93
PID 768 wrote to memory of 3952	768	msedge.exe	98
PID 768 wrote to memory of 3952	768	msedge.exe	98
PID 768 wrote to memory of 2112	768	msedge.exe	99
PID 768 wrote to memory of 2112	768	msedge.exe	99
PID 768 wrote to memory of 4552	768	msedge.exe	101
PID 768 wrote to memory of 4652	768	msedge.exe	100
PID 768 wrote to memory of 4552	768	msedge.exe	101
PID 768 wrote to memory of 4552	768	msedge.exe	101
PID 768 wrote to memory of 4652	768	msedge.exe	100
PID 768 wrote to memory of 3384	768	msedge.exe	102
PID 768 wrote to memory of 4960	768	msedge.exe	103
PID 768 wrote to memory of 4960	768	msedge.exe	103
PID 768 wrote to memory of 4076	768	msedge.exe	105
PID 768 wrote to memory of 4048	768	msedge.exe	106

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ptk.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cosmeticapampa.com.ar/ptk.exe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc57fbc188,0x7ffc57fbc194,0x7ffc57fbc1a0
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,1749584768762427810,3242096121305385298,524288 --field-trial-handle=2288,i,6490560258808307826,7041500936818306889,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,16089971315578182828,2676934226531492871,262144 --field-trial-handle=2288,i,6490560258808307826,7041500936818306889,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,8465714121505533579,11516426797039341437,524288 --field-trial-handle=2288,i,6490560258808307826,7041500936818306889,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,5980125057357475953,6998392056430782975,2097152 --field-trial-handle=2288,i,6490560258808307826,7041500936818306889,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,11691250147118691941,14773077578034236790,2097152 --field-trial-handle=2288,i,6490560258808307826,7041500936818306889,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,18224697028719696943,14852777202789379619,2097152 --field-trial-handle=2288,i,6490560258808307826,7041500936818306889,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,11206372324913656223,9456326023940817867,2097152 --field-trial-handle=2288,i,6490560258808307826,7041500936818306889,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:2
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,4910553581239592045,3939935333600610034,524288 --field-trial-handle=2288,i,6490560258808307826,7041500936818306889,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,12316128930288217544,838607714613069498,524288 --field-trial-handle=2288,i,6490560258808307826,7041500936818306889,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,2990917649191262304,17343740953498917106,524288 --field-trial-handle=2288,i,6490560258808307826,7041500936818306889,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5972,i,3857529399110793028,85532368718588275,2097152 --field-trial-handle=2288,i,6490560258808307826,7041500936818306889,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,1172026491870221390,7288274445906461406,524288 --field-trial-handle=2288,i,6490560258808307826,7041500936818306889,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,12151015201410971394,15942775683762004459,524288 --field-trial-handle=2288,i,6490560258808307826,7041500936818306889,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,18334060448807843752,1829285684799350359,524288 --field-trial-handle=2288,i,6490560258808307826,7041500936818306889,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,18334060448807843752,1829285684799350359,524288 --field-trial-handle=2288,i,6490560258808307826,7041500936818306889,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  PID:4076
- C:\Users\Admin\Downloads\ptk.exe
  "C:\Users\Admin\Downloads\ptk.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1680

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4764

C:\Users\Admin\Downloads\ptk.exe
"C:\Users\Admin\Downloads\ptk.exe"
1⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
PID:3656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c756e7f0173c2e46dad26d72efbfb0a42b35deefa8d8ed2308e4410b46b600ee
MD5 509bff51589c8be5e43f296423d20aac
SHA1 bd50ef22bf1362528eb591a13feb31f3231bdc04
SHA512 0a6364f7f6dcf2e0b00fd8e5b79f4583839b1b3e47f62102d14f4cf4f19c507ca7d7aa64e2f107b5f954db5341186688dd1fa2c0c0a1fc1e46de166184e5949d
TLSH
T1ACD02370B53577D2D21F007D44706B015515817772B7B7517166680DDF70085F1DF9E5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 312KB
SHA256 e64e855c04b00a3e61fe91eee9999817d273a2c4f9fef5cb9f2d3e6e3ff4fb56
MD5 be3f5461bd6614268faac9e7d68cd746
SHA1 969b0ee6c555222c5831c4f84b6e346e93819e31
SHA512 ee682f5cc9099b6da0cf12287f950ab911c4254874cedff50f02d80d300d7f149439a43daaab145ed2ca79af812488807898382f20d33942e47ac9cdafdd8288
SSDEEP 6144:8NYIUqNNiVlRgSgMPfZZFR8MqxTRqanIoBHvaWlbIy:nJqbAP37FJOVq8IoBHvaWlh
TLSH
T13A64BF0677FB4F11E7BA0B74A8B304140372FA96BA33E78F2658029D1DA3754DA1539E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 84611adbd4b46da53a9446b9077ec478a5b32ead4357d7041de5ff04b3d0642b
MD5 239588bf4f1ba86ca5d065ee5c700038
SHA1 947f56c61d84ce49df29d2d1a64ad01477386cbf
SHA512 e1c3449953364267f7c7ed31a5bd5a66f70984611280b16de49a3f5b3c21e01b296c03a7528cd793fee24cc15baa884555f4b1b5bddf85c1c036725e828d17ac
TLSH
T18171E63B0139446DE353C17186DA82123C7A4EEAF5D35E4570E05B3D55813F1DD26A8B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 73ce499ce76b736a3d7b236a72af903f2d3e4d23a9320076cf6101059800dbdc
MD5 3bcb6a8ce1228f1ea1d848f067f81866
SHA1 5980fbc45a75b43b21926a90555a889c22709284
SHA512 4a6ec1394e4ab73265e8dcb8ab16e9700ea1ea4573f9d543b029ff137cfb9176bccdc3d516792964ed089b9e86f1839aa5c716da809d42b6a35c382d814596ee
TLSH
T138117DB3C3E5856E8A1516F06A24AE2BCE2D0505421C7C29C5D4FF2BD3E3476E00299F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6077d87aea0f18d6cacaed46f5a116bc86db556cdd3738907c4eafd356319e23
MD5 f9735c010b9393d9341fee482210d5bc
SHA1 d3d90edb1e55b4ad35705bbfd9435a163a8a69f0
SHA512 4e2582094ab6c22c6d23f9c946f6be2c7c23a0905da85075b04d1212f0795ff3e2f03c2bb2b62a5969847bdd21ce5cfb4ecb84770bfca4c3496f38976dccfa87
SSDEEP 192:sxZKEZRTMyM/jK1Ml8O9jJ/fDTssWpVFOpUbIdpJHW6+WNGYImun9OnIgFJ:sxZb6dd/fnssWvFOXJHbG3Kv
TLSH
T1CD52E6166A34997BCCDBD20DFA557F53D6F80463A2901E48A9FC9A0C04E7AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 81d35c3584d2173fd4d8c04e318860330d8875666143d88fec253eb6c0c46473
MD5 430038d2d6ddf889430a3d6b80ba8433
SHA1 a63588f0e0885951dbd8dec7e8558023e38cb06a
SHA512 3ed14db7ecd7befddffce24e43e8e868359a64cd36f8dbcf6fd7712e4aa0746622e2a76dda84496bf1886bb7972849c813027ccc60550130416b847b4fd98dcc
SSDEEP 768:XLsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9gro/Xlo:XLsqxXlWvJD6Tu1ja54LAs9rv+
TLSH
T15CD21B3B694CC77E4F840E5DEC26AFD76ED801CBA6988D5447FA890C03CB2EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 72b014456d440e71dbda3f6ffdc183304249071bcb93337a0099419623ee0544
MD5 68c2c2628e597d1f090a759303e2e39b
SHA1 ac4be5d8d0a4f42b45aab79e502dc42d6e018aae
SHA512 946188df1a8ec7df5105241e3459b2e21d9cc1c5dc2ae57c21670fba0df38873e6c93de0ceb5050386abcc5882e0ada0336b3bba58095e97fd28517d0bafb653
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyJ2IXK7KEHyh5CIfKfqMHy5WInKPK8rw:KYbaKYIKa2wK7Kui5CAKfqGqWgKPK8w
TLSH
T16DD1FF47753B02427CBD2908A7FA96378F4232A33419A46F3FB851A65E66E110DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 8bfe544ba66378598147aa6f367205594d60814a8b1697e451e0d698fe523ac5
MD5 e1df49e403ed7f6a691b50d61c0c603c
SHA1 ab55972afef32f41458bacf3403c6d0a43a8c104
SHA512 825896fd7316ab452cee54fefe98202b43300f9f8a684f112efcdbb7948dfd760be11f43e681d4725850d995e8675d6616d2c3293d691898bf03cd89ff0b3f5c
SSDEEP 384:GZcIHsNPU829qbO4Wd9VRNkd/BhVvFA8Bvt1of5mkcQDOObjI9G6w7nS:UH19djHkf/68mf5UQD29MnS
TLSH
T123C26A71EC640DE744A2E5C66486E5136EF4513BD69D1A8CE2F8BB3D30AF8B84316C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2af8b4987af95d1caf5742436a8b3d5a6e376f26e475c297fa10d5132d3ff744
MD5 36c3a3de885244d6618686f52bd9138c
SHA1 470757e82e32b470c6a53c36a8e90ec3a3520287
SHA512 ca1a8fa5cdb497349659e0f54d35788dd51c0eacb3ab458ca5c300a82a6e4e824868fd8fc9f4f36003834714297652dadc912eda5ff7742b527911eb72b49f2a
SSDEEP 192:tONu6JkRtQmiUyKXKtW+RNX+Fd10IeReh3BGPR7U6:tONu6UrMW+RNkd/FslU6
TLSH
T19D02C835AC382C7B9EF2AE0AB58727175FE4117BFA992B84D6E81F0C01D765C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5ce9c3148065a07c0c636fbbee20af7d26b29ff93d561a3454ffbea3a8d7d020
MD5 08697578953b4652c526577cfea7527c
SHA1 2ce5b880927259a602547859c938aee9097b1342
SHA512 75f9eb30bfea2146e39f3ec6e50a0716b62620af1022b4baa08b394d99bb27d7d87cd76e0750a927a4908dd31f0840430fc5b4336fe58fdecb67b0b1a87b5642
SSDEEP 192:w0ONU46JkRnoQmiUyKDKtwG+RNX+Fd10IeRfFxVcBpq+mU6:jONF6UIUd+RNkd/FQU6
TLSH
T1F312D73668386C6B4EE26945F48736135FE5516BEE8A7B8495DC1E0C01EF6AC130AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e3f4c95caf7bef86bb05be5d5f21e4cec18a64f7e096b6d4341851bc3a585c51
MD5 ff84453b86f6509566a5d20932a677fc
SHA1 9a871cf3fe45b7b4d090bad361564f151198c70d
SHA512 ea03046fa96256cdcef057233ca351add714f37c2f9923205a03a52cdfde0fabd46fa9df3e60d4697f7fd9724e220cdca3e5314610749ac9d9364233030ff080
TLSH
T1E1411858BBF91158F3B7BE5AABF7A46D447E78672F06D45D10110E4F0622A40C8A1733
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4048-163-0x0000000005140000-0x00000000051A6000-memory.dmp

Download

memory/4048-160-0x0000000005680000-0x0000000005C24000-memory.dmp

Download

memory/4048-159-0x0000000000530000-0x0000000000584000-memory.dmp

Download

memory/4048-262-0x0000000006510000-0x00000000065A2000-memory.dmp

Download

memory/4048-263-0x00000000065E0000-0x0000000006630000-memory.dmp

Download

memory/4048-264-0x00000000066D0000-0x000000000676C000-memory.dmp

Download

memory/4048-265-0x0000000006690000-0x000000000669A000-memory.dmp

Download