hxxps://urlto[.]me/2hRzs

Analysis

geolocation tags

asiadelhiinindia
max time kernel
58s
max time network
52s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/08/2026, 20:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://urlto.me/2hRzs
Sample260803-zhy12sfe26

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4104	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302635285482184"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2043432456-1617298091-2772621413-1000\{F171158B-ECC6-4454-9135-B2BF4A07921F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2043432456-1617298091-2772621413-1000\{C5C1F9CC-83AD-45B8-9407-BAAD66E95ECD}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 2812	4520	msedge.exe	80
PID 4520 wrote to memory of 4104	4520	msedge.exe	81
PID 4520 wrote to memory of 4584	4520	msedge.exe	82
PID 4520 wrote to memory of 4584	4520	msedge.exe	82
PID 4520 wrote to memory of 4584	4520	msedge.exe	82
PID 4520 wrote to memory of 3248	4520	msedge.exe	83
PID 4520 wrote to memory of 3248	4520	msedge.exe	83
PID 4520 wrote to memory of 4876	4520	msedge.exe	85
PID 4520 wrote to memory of 3580	4520	msedge.exe	86
PID 4520 wrote to memory of 4876	4520	msedge.exe	85
PID 4520 wrote to memory of 4876	4520	msedge.exe	85
PID 4520 wrote to memory of 3580	4520	msedge.exe	86
PID 4520 wrote to memory of 3580	4520	msedge.exe	86
PID 4520 wrote to memory of 3540	4520	msedge.exe	87
PID 4520 wrote to memory of 3540	4520	msedge.exe	87
PID 4520 wrote to memory of 3540	4520	msedge.exe	87
PID 4520 wrote to memory of 4332	4520	msedge.exe	88
PID 4520 wrote to memory of 3316	4520	msedge.exe	89
PID 4520 wrote to memory of 4356	4520	msedge.exe	90
PID 4520 wrote to memory of 4332	4520	msedge.exe	88
PID 4520 wrote to memory of 4332	4520	msedge.exe	88
PID 4520 wrote to memory of 3316	4520	msedge.exe	89
PID 4520 wrote to memory of 3316	4520	msedge.exe	89
PID 4520 wrote to memory of 4356	4520	msedge.exe	90
PID 4520 wrote to memory of 4356	4520	msedge.exe	90
PID 4520 wrote to memory of 2372	4520	msedge.exe	93
PID 4520 wrote to memory of 4324	4520	msedge.exe	94
PID 4520 wrote to memory of 3120	4520	msedge.exe	95
PID 4520 wrote to memory of 2372	4520	msedge.exe	93
PID 4520 wrote to memory of 4804	4520	msedge.exe	96
PID 4520 wrote to memory of 4324	4520	msedge.exe	94
PID 4520 wrote to memory of 4804	4520	msedge.exe	96
PID 4520 wrote to memory of 4312	4520	msedge.exe	97
PID 4520 wrote to memory of 4988	4520	msedge.exe	99
PID 4312 wrote to memory of 616	4312	msedge.exe	100
PID 4520 wrote to memory of 4724	4520	msedge.exe	101
PID 4520 wrote to memory of 4724	4520	msedge.exe	101
PID 4520 wrote to memory of 4724	4520	msedge.exe	101
PID 4520 wrote to memory of 4572	4520	msedge.exe	102
PID 4520 wrote to memory of 4572	4520	msedge.exe	102
PID 4520 wrote to memory of 4572	4520	msedge.exe	102
PID 4520 wrote to memory of 1872	4520	msedge.exe	103
PID 4520 wrote to memory of 2056	4520	msedge.exe	104
PID 4520 wrote to memory of 1992	4520	msedge.exe	105

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://urlto.me/2hRzs
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffd198bc188,0x7ffd198bc194,0x7ffd198bc1a0
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,12939553391201489911,6769087070138214873,524288 --field-trial-handle=2108,i,16871171642749937611,15326042768386833132,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,14947117800209648375,9907214147126226516,262144 --field-trial-handle=2108,i,16871171642749937611,15326042768386833132,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,13745594135614591862,343547499537085784,524288 --field-trial-handle=2108,i,16871171642749937611,15326042768386833132,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:13
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,16197241494437240415,14130843977332283883,2097152 --field-trial-handle=2108,i,16871171642749937611,15326042768386833132,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,11479605637579297906,11918293463339970731,2097152 --field-trial-handle=2108,i,16871171642749937611,15326042768386833132,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,4324951429678333004,7923231327866180811,2097152 --field-trial-handle=2108,i,16871171642749937611,15326042768386833132,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4244,i,18374034470381847076,6358821181209230403,2097152 --field-trial-handle=2108,i,16871171642749937611,15326042768386833132,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4276,i,17937875293152419567,13415066104966341598,2097152 --field-trial-handle=2108,i,16871171642749937611,15326042768386833132,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:9
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,11251070819489555341,11149094756472168269,2097152 --field-trial-handle=2108,i,16871171642749937611,15326042768386833132,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:9
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,14983335307615244789,5125809865099466809,524288 --field-trial-handle=2108,i,16871171642749937611,15326042768386833132,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,14800345781436425822,2257453659071951580,524288 --field-trial-handle=2108,i,16871171642749937611,15326042768386833132,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,13911547506477382773,4653372986762679019,524288 --field-trial-handle=2108,i,16871171642749937611,15326042768386833132,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
  2⤵
  - Modifies registry class
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,2909200847671982403,11944866651871183303,524288 --field-trial-handle=2108,i,16871171642749937611,15326042768386833132,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:12
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,646533125649722616,14793209470787771920,524288 --field-trial-handle=2108,i,16871171642749937611,15326042768386833132,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,10886017186829837202,12483034153159608927,524288 --field-trial-handle=2108,i,16871171642749937611,15326042768386833132,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,10886017186829837202,12483034153159608927,524288 --field-trial-handle=2108,i,16871171642749937611,15326042768386833132,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6836,i,13844561795681907267,9842211067109563926,2097152 --field-trial-handle=2108,i,16871171642749937611,15326042768386833132,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6976,i,11984566033720876790,11737238999091588583,2097152 --field-trial-handle=2108,i,16871171642749937611,15326042768386833132,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,9666674407361246669,4411331455626871678,524288 --field-trial-handle=2108,i,16871171642749937611,15326042768386833132,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:14
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,12635648271030446750,6475272984405364341,524288 --field-trial-handle=2108,i,16871171642749937611,15326042768386833132,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,806362515508179876,12953622694237334236,524288 --field-trial-handle=2108,i,16871171642749937611,15326042768386833132,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
  2⤵
  PID:1992

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1b87229f99cc53c652c227dd7b0e674fd1a7f3d2071ecbd7e96d14caf01789e
MD5 12fe7e86ea55bcbc14173d158228b533
SHA1 4d08fab080251fc755b72705a654e4971294953c
SHA512 5f7f520a3c5a907c7487d7831cea4efeb50450367f23409af02c5269a3fd34cd57d86191174e7c2c1b103980b98f431afe701795717921d9887b0f9bcbc45b3e
TLSH
T199D02B7111090041C40D0032107386054303FF010A0578433C6134252D10C09834E094
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b8343eede7062d708cfd9e20302d96291a017139b4f4fbeae84a2b762f28cc8d
MD5 cb23137230a5c56d18ba7eb9fa023f00
SHA1 ee9040a88c17ae71384ead4f943f25a19d763765
SHA512 e5efcb641190b64fe444d20403a22dbe898f014562d2f231301ebcc051f8cdd46c19b7ebf63efafed7e2683353afbdb18a461b61cf4f41b6823db5f47d9cd94a
TLSH
T10F51202F0F6201E3D31E13F091D09261363680B68533AE2DF19C897E2ABA775FE2156C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6041d7d7-35d1-4b3e-83aa-d21513a84732.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6041d7d7-35d1-4b3e-83aa-d21513a84732.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8e78613ff78304413c0aaf6b0e96cc09a173b30b71bbf865b764d118551f5e5f
MD5 28291f2a526a1760c8c9f0ede0af5026
SHA1 a537e349629169a1be95ef690b8704a1ef8ec468
SHA512 9c94ba02895d5c9ad5c97fdd1740c974ce960ea331e101a2ffd6f24f49eb92915f6163eac35054c3495d480503552d0fd2550ecfd0348ce90d76535953b08c71
SSDEEP 192:sxZ3REFb/fLsAdoiIdpkE//W6+WN2Acsq/Y014FtwIgrJ:sxZ3wb/fLsAdoLH/bVa/5P9
TLSH
T18B32D8526A78A8379CCBD209BB55FF13E2FA503291D41E54E6FCA51C04E7ADE620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 398ea88a4f9cc659064d1e3be1be44062c85ab78a36379144723fe2566e0e5aa
MD5 1916c9db7d1436084be72236807809a0
SHA1 8b9b4ee0f0f6f454ef2361134df283e62cc4e729
SHA512 8752dbb26b5f4c463b0edb696042719bef2a7d13d885b239318f72627f03d0896be82bc44264760c915b5df89624e48bc35006dcd2feb931bb116969021bbb56
SSDEEP 192:sxZ3REFb/fLsZdviIdpkE//W6+WN2Acsq/Y01EJtwIg5cJ:sxZ3wb/fLsZdvLH/bVa/5zW
TLSH
T18E32E9526A786C379CCBD209BA55FF13E2FA507290D40E54A6FCAA1C05E7BDE520740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 84c2ed36b44f79e8bdc3ab85a12b8fd972afcdba948e15e73ef969940173686e
MD5 e5a7b96ec00c5864e06dde0b30996637
SHA1 ddb4aa440e288ccf037341e13ef5bfd045c8cc27
SHA512 82fe65042141b1a22385bae3d551cf1744e4f1a363220d79c4d3148862d1b6097166eade763dc193f85b8c3c5bf428451aff89c7561004621a2bf4921d0086a2
SSDEEP 192:sxZ3REFb/fLsZdoiIdpkE//W6+WN2Acsq/Y014ZtwIg52J:sxZ3wb/fLsZdoLH/bVa/5Fc
TLSH
T17A32E9126A78A8379CCBD209BB55FF53E2FA507291D40E54A6FCA51C04E7BDD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 28KB
SHA256 6625c40ee8626b735f357f09599e79d2b047e14c18a2d6c7afe79db9add738fa
MD5 fe3766dc0b80d88ae93af2cff84ac496
SHA1 23bad0ab0af2104324373f140e2c68a02a02ecd2
SHA512 bdec524f42e78f2694e2e1e8d4ff9c3b6c1b161f51dec3adb9dfaa7825a444901f88865af16058b034a058bb3bf3a7dbde73fac0105c31e722eb1872a071032b
SSDEEP 768:O+4bSX4b+8+4bm2K4bRWRmG4b/QA4bH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3A4n:ONuo68Ni2J1WRmlzQ3ju1jaK3ILpZ8Um
TLSH
T1F4D2FA3F240CCB7E5FC00A5DDC566F972EA802D796688D4047FE994C02C77EAA12A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 db465f12dea6499918ac029382879b5801bb0a03bc25be85fa9296f11c44ca66
MD5 079b806172769e349cf0703ecae0c655
SHA1 f720737e3e78a0dbb9312750597ad3010a4338f8
SHA512 39bc63e6639c2930493f74e23fbc66c22965e65f3f185b7880d048c08e9c9591b5a2215d24a75916d0cc6d345608942a1c477668a305acf6b6744860188f86d7
SSDEEP 24:KdNfIbyaXd/bT4rP+iIjHTKi8hapT1EVDSm9MY8bwyXYPfWdUaRdFVF4Rt+4IjxY:KUiI/KTKI/yZkInK1Oc3yZcITK5iET
TLSH
T15991E05274BB03437C3E2A48B7949B661A42F1A33158AD2B7BEC40B55E27E104CFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6cb1316bc529fa4fbb2cfabff030697e2bbd6758f05aef56fb281ed871b8ad5a
MD5 e3249301779051bb1a4dc3c07d94c587
SHA1 e6906c17283f348f66b40f89610e64a183f5e421
SHA512 2ed2a370505b2fac57961e4b2cfd5b1a2719db619b9d336a1b379da11b1af4a74b5b0e38fa62c6606cab0ccdab7828bd7b0e658be4a42b047ac1d3f7ea9694a3
SSDEEP 384:dZcI68NZxN1zltr3b+A38xfXKMZKLtuMAo4gh9Cu3XZUa:F6k5rpSNZKLtrAo4KCu3XZUa
TLSH
T1BD928E315C74AC375DF7A685B94739138FF4C067A6C82F9099EDBB2C04DA59C130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 258c73746e937c7382125c3a1f67ec923ec425e670be00d9d647a37ed31e1191
MD5 9833933e29248c44cbb7fdef940a6053
SHA1 3e49c4f996312a977c64eda3a9b39aa973e25a36
SHA512 b983f8033480bc0f0d28f86e639578a3d7091d978802b1c17421acac37fb23c2d362c420d2b7586980a770eb5e9613678a3e907757f0ee9c70babcb038d71d5e
SSDEEP 384:PZcI68NZVN1zltr3b+A38xfXKMZKLtuMAo4gh9Cu3XZUa:H6E5rpSNZKLtrAo4KCu3XZUa
TLSH
T161928E315C75AC371CF3A585B94B39138FF48067A6C82F9099EDBB2C05DA69C130B92E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7bd7e0627761afca9645bdf358a072b40d9d1dce4c600e84b7397a87b35cc629
MD5 3949d2776fa50a6748ab197355df56b5
SHA1 e2637c040d666fdd69d8cd015fceca18c4d80d72
SHA512 c163b89c5521bdee35c5280642295b5ad2fe086b29f59a5bf05333351d08451514dc29b2ec07ed0522188735578fe58647d4f22a159c2249adf83a3e19d823ec
SSDEEP 192:lGNk6y7QmiUyA0MvY3b+jcvjzorrFPdmwXL+Z4MsqnU6:lGNk6kDvY3b+A38xfXKHZU6
TLSH
T10E120A32A868AC2B5EE2A585B48735139FF54127EA887F80D5EC3B2C00DF65C530BD5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4c7b8a8f837a46e240919c810fba3289efbf59869d937626898d9147a7fdf02f
MD5 474655c278155dabbd2a9a6ddd2dbb8c
SHA1 f7ed4c836fe5d0a717767699f72a0a69f7d9132b
SHA512 a3357cd262af13308a81ffd6b20ece778c86f1e3950257153e2cb48dd93e7c54b99e3a698badbe07b6f9a62d10bfc79161469daf693a0ca1d5ca7f99416a91e6
SSDEEP 192:nRGNT6yMQmiUyYJmM1Y3b+jcvjzorrFPdmkMndAU6:RGNT6x/v1Y3b+A38xumU6
TLSH
T1D202FA31A8786C7B9EF3AD45B48737139FE4116BE9953F84DAE82B1C00D765C230B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 88f1768575c1f34d1f8f959e228030fb8ee131f24f124da3dafc4f726b4385b0
MD5 b2309e9adf2bd06a46bd5df77f653523
SHA1 d6d7a62dfc586df2f4ac4e1739d2101cf841f75a
SHA512 9598124dd36c6128d0997c454f3e294434c2ca6ec3f62ccd9e86c7d52a642b912bd98952a159ce8719d5037d5fc77f1be4d41c1d78a9454478bf327645a35451
SSDEEP 384:hZcI68NZwN1zltr3b+A38xfXKMZKLtuMAo4gh9Cu3XZUa:p6d5rpSNZKLtrAo4KCu3XZUa
TLSH
T197928E315C75AC376CF7A585B94739138FF48067A6CC2F9099ECBB2C049A69C130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c44b192-e7f4-4897-a428-43ffb4669f4a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2c44b192-e7f4-4897-a428-43ffb4669f4a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads