hxxps://grabify[.]link/3K5KW4

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
131s
max time network
132s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/08/2026, 10:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://grabify.link/3K5KW4
Sample260804-mzf6cadj4x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1816	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303144632764625"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2043432456-1617298091-2772621413-1000\{8DB6B451-DE49-41B1-B3C1-279FCAF8E989}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 5180 wrote to memory of 4100	5180	msedge.exe	80
PID 5180 wrote to memory of 1816	5180	msedge.exe	81
PID 5180 wrote to memory of 396	5180	msedge.exe	83
PID 5180 wrote to memory of 396	5180	msedge.exe	83
PID 5180 wrote to memory of 4092	5180	msedge.exe	82
PID 5180 wrote to memory of 4092	5180	msedge.exe	82
PID 5180 wrote to memory of 4092	5180	msedge.exe	82
PID 5180 wrote to memory of 1940	5180	msedge.exe	85
PID 5180 wrote to memory of 1940	5180	msedge.exe	85
PID 5180 wrote to memory of 1940	5180	msedge.exe	85
PID 5180 wrote to memory of 2840	5180	msedge.exe	86
PID 5180 wrote to memory of 2840	5180	msedge.exe	86
PID 5180 wrote to memory of 2840	5180	msedge.exe	86
PID 5180 wrote to memory of 4244	5180	msedge.exe	87
PID 5180 wrote to memory of 2132	5180	msedge.exe	88
PID 5180 wrote to memory of 3496	5180	msedge.exe	89
PID 5180 wrote to memory of 3472	5180	msedge.exe	90
PID 5180 wrote to memory of 4244	5180	msedge.exe	87
PID 5180 wrote to memory of 4244	5180	msedge.exe	87
PID 5180 wrote to memory of 2132	5180	msedge.exe	88
PID 5180 wrote to memory of 2132	5180	msedge.exe	88
PID 5180 wrote to memory of 3496	5180	msedge.exe	89
PID 5180 wrote to memory of 3496	5180	msedge.exe	89
PID 5180 wrote to memory of 3472	5180	msedge.exe	90
PID 5180 wrote to memory of 3472	5180	msedge.exe	90
PID 5180 wrote to memory of 5268	5180	msedge.exe	93
PID 5180 wrote to memory of 5300	5180	msedge.exe	94
PID 5180 wrote to memory of 5268	5180	msedge.exe	93
PID 5180 wrote to memory of 5300	5180	msedge.exe	94
PID 5180 wrote to memory of 5416	5180	msedge.exe	95
PID 5180 wrote to memory of 5444	5180	msedge.exe	97
PID 5416 wrote to memory of 5544	5416	msedge.exe	98
PID 5180 wrote to memory of 6024	5180	msedge.exe	99
PID 5180 wrote to memory of 6024	5180	msedge.exe	99
PID 5180 wrote to memory of 6024	5180	msedge.exe	99
PID 5180 wrote to memory of 3512	5180	msedge.exe	100
PID 5180 wrote to memory of 3512	5180	msedge.exe	100
PID 5180 wrote to memory of 1692	5180	msedge.exe	101
PID 5180 wrote to memory of 5208	5180	msedge.exe	102
PID 5180 wrote to memory of 2352	5180	msedge.exe	103
PID 5180 wrote to memory of 5436	5180	msedge.exe	104
PID 5180 wrote to memory of 5436	5180	msedge.exe	104
PID 5180 wrote to memory of 5036	5180	msedge.exe	106

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://grabify.link/3K5KW4
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffad0a8c188,0x7ffad0a8c194,0x7ffad0a8c1a0
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,17115427104415337959,18222951099327330412,524288 --field-trial-handle=2176,i,1932807688897049503,3484412301061458188,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,1865391284980137553,1076501570254455431,262144 --field-trial-handle=2176,i,1932807688897049503,3484412301061458188,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,2359860611679969904,829310113031655658,524288 --field-trial-handle=2176,i,1932807688897049503,3484412301061458188,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:13
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,6976714506275676730,13907511752329518303,2097152 --field-trial-handle=2176,i,1932807688897049503,3484412301061458188,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,4739631047213145577,1681029444085426366,2097152 --field-trial-handle=2176,i,1932807688897049503,3484412301061458188,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,17722513757722642394,8816317300329044734,2097152 --field-trial-handle=2176,i,1932807688897049503,3484412301061458188,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4256,i,10450564062382370304,2666569453143455164,2097152 --field-trial-handle=2176,i,1932807688897049503,3484412301061458188,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:9
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,17522974690998048271,14377019086416959144,2097152 --field-trial-handle=2176,i,1932807688897049503,3484412301061458188,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:9
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4236,i,14423075569895288738,3481924791134396328,2097152 --field-trial-handle=2176,i,1932807688897049503,3484412301061458188,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4652,i,6235550448394699584,9942564158560994484,524288 --field-trial-handle=2176,i,1932807688897049503,3484412301061458188,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,15666315609205960076,11372224414585615292,524288 --field-trial-handle=2176,i,1932807688897049503,3484412301061458188,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,3307128881625771429,16343181865151642787,524288 --field-trial-handle=2176,i,1932807688897049503,3484412301061458188,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5416
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,1996203934025098922,16519849273059370524,524288 --field-trial-handle=2176,i,1932807688897049503,3484412301061458188,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,1996203934025098922,16519849273059370524,524288 --field-trial-handle=2176,i,1932807688897049503,3484412301061458188,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6556,i,1130801843438005719,1590782620348488916,2097152 --field-trial-handle=2176,i,1932807688897049503,3484412301061458188,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,4253338059690458958,391482305800031777,524288 --field-trial-handle=2176,i,1932807688897049503,3484412301061458188,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:12
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,8715997357368275213,7182251444753470151,524288 --field-trial-handle=2176,i,1932807688897049503,3484412301061458188,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:14
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,661598167570406380,14843489354665060824,524288 --field-trial-handle=2176,i,1932807688897049503,3484412301061458188,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:14
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,9850400840923981213,13472862075297608879,524288 --field-trial-handle=2176,i,1932807688897049503,3484412301061458188,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3936,i,14523770935857291215,16940302703366156881,524288 --field-trial-handle=2176,i,1932807688897049503,3484412301061458188,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6512,i,9572489106377960997,17858962357150857820,262144 --field-trial-handle=2176,i,1932807688897049503,3484412301061458188,262144 --variations-seed-version --mojo-platform-channel-handle=776 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 277d166afdc80114939dc1cb5348403e870f5cb56d92a843caf2a100222a9cf7
MD5 ea81e791ddf35b22b319899cd00fce40
SHA1 fbaddbb263d48055cb0bdece53f1c1b103d780ee
SHA512 a06631511986d8078249b2772ab993e232445d619443c3e4a87f4e97b50b924bbf308b9106d1a6a3fa817215e570f5d2be1fb2523cb1c52eb112923ffa082673
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T1A7B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dcfc4c476f41db2d6042449b7b855b9751140e2127be8e8208aafd46a5893b7d
MD5 08e448ed3ad1512fa216c2eea50fff9a
SHA1 2d684e6af180cff0b8adea283dbb0c009102fc3e
SHA512 f9ebe4d980c84e665fbd9643a31fbc7a6b08028d289cd54ea7400acc1d6a7d231dd7952c9c49775207225efebf00cdaaf6a2b295dbeac8f234ed7bdfa52c4693
TLSH
T122D0C073050D0000EA0D41312073C7050313BB210E013C03B855F8381D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 89ab71a3a4e732da8cbbe2e13ba149e13c94226b7119c8a0598106b99907544f
MD5 ca938be236bc251b79a4ee9dbf06dd19
SHA1 2ed95a78846a95a90b8d9b70e9cdc6188f0ce608
SHA512 caf4662a529a373a26b513e285938286f3af46a8729fb4c0be324b084fdba1e10dacca4b8f67585c4a5c6683f45dc7e259548eaf3ffb985905aeefbb7225e0e7
TLSH
T124D0C073050D0000EE0D41312073C7050313BB210E017D03B855F8380D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 81741ca6fcd78cb5b84c6d11e2f7f2d073442f059a7dfb12bc1db21fe83a80a1
MD5 95b54637366507b04a5c338e1103d098
SHA1 f201d23d3d540850d69c596c30c5c8f69ae37e9c
SHA512 21371583e23216c195fb5bd3f9a04f6752afc0e3390f0bdf63874d021eb5f02a4953f593afaa5e4907bb2829a1ed640a400805388ce064c7913ebe000aeeac96
SSDEEP 96:sFmRGBmRK0zSwCMjqcMqfm2Qc1HIXxukEOXWxPfNiE:omRGBMpQcM5MWVEOXiXNiE
TLSH
T13591B6A459C1E963EB7A1FF36DD41D0E34F204854A634F57017068BA220EFE0C6B6F29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58c52f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c52f.TMP
Size 3KB
SHA256 dbb00149acbe8338d3a14f5dfece5c90f561ae8a066a5cb2006df6f222032bfd
MD5 9e9b689b30e4c387891374fefdad3a47
SHA1 3f690e26a4354aeb571a444611a582f1b4986c68
SHA512 396cf1ac768261073b18fbe7b719cd117b92a99f3be370f0bfbc6f9dae6d64c3c6bf5a36925f93db1f850e3a2cf3d3ec2808f01e1912bc00b294b898e5d0ae0f
TLSH
T17D61B3B52546EC73E3752FF3ADD11A0E34F2449A89130E4911B4A9FA2512FE1C2B1F18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 46a5829466b4ef4bcf4fe5e1ddc5a0e03a542f0102be359f0b2a9224bdce56b3
MD5 5b3f78175a4dda51393ec6241b968539
SHA1 148907da837e076920ec78320a739f28bdbd3d1b
SHA512 3687dce96912c76014324e3fb6994ec0caee58be847ae6287687fb96077ebed3f40be6d20cd28ad32995c7ab3afc0dd0f14730d1f01344aebc8916e735262c40
TLSH
T135517AF787F4A56E8E2152F0AA186E2FCE1D0515435C7C6AC9D4AF1B93E3470E201A8F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 357060decf4fc0c6e635d6173fb369fca9bf1d04b438501739678447008a319b
MD5 6cbb7f541187ff532f430c0ee8289a30
SHA1 8ca8d1b957c5d35f4e2e49f959e51c71c78d215f
SHA512 1c9f56a164c728f494f2fd74bcdd878fc3fa8971c1b1d2a6ce8b553b6320a3e10217a2bdf624ec4088cae2837ef32c96360b322b1532e616204674f9a1fb7af4
SSDEEP 192:sxZWXR7yM/jK1Ml8UQlFt/fusL9N+EBOIdpSKG/W6+WNvWSf6EYuBY018CJY6IgX:sxZ6tqDt/fusL93Bfy/bX6GB57fuG
TLSH
T14062F956A6345977CCDFE20AFA45BF53D2F5647292900E44AAFCDA1C00E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 11ebc82b1a23422e90134a9c8186d62e8a8cb005b08918c7dbec2d8daa13d585
MD5 f80f0a2d6fad59bdbfa971a4aa763126
SHA1 89dafaee78699b665177cf3f6245ff42cfeb9072
SHA512 864eedda6cef7c18f1fb8feefa9e647cf8670fcfecf9c0ff0df7ed5d3a5b3ba356c79b31de472d13a8e38921a39e99c522a188ee7f94151091e456aafaa340a2
SSDEEP 192:sxZWXR7yM/jK1Ml8MFt/fus79N/EBOIdpcKG/W6+WNvWSf/Y01vVfY6IgrJ:sxZ6Ddt/fus79eBfU/bX/5Lf9
TLSH
T12752E7126A346977CCDBE209FA45BF53D6F9557292900E44AAFCDA1C00E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c8a7186e9319d4b6b624739c79e7d08f2f522aa45de2bfcba91ada38479cc5e2
MD5 1638286b39fff707117d6d334a6cae53
SHA1 d0518bda9478edc12ca92b178bb71120daaf7480
SHA512 111a36b5473460c0ce3d26f308005c205961ed874f015e8e26fba23804a68f4d1894da47b5b52da3ad449f656afbe2210f0511e58ecb4ec3f8795591f5887a12
SSDEEP 192:sxZWXR7yM/jK1Ml8MFt/fusL9N/EBOIdpcKG/W6+WNvWSf/Y01vJfY6Ig5pgKJ:sxZ6tdt/fusL9eBfU/bX/5ffAG
TLSH
T15A52E815AA345977CCDFE20AFA45BF53D6F95472D6900E44AAFC9A1C00E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 1726ad181965f89fd1c73695ca258f49363d855d9a762fae6732ffbe3aef26b3
MD5 5c0909869fc0c10f524d635fe74b6974
SHA1 d8c53ba56cf472dbb1032820f01748bc62a87229
SHA512 8d3bcfbff523d368defdb49b01c39d0ba3fd9fba67b0f9ea6ea9b19201bdbede8ee6b705a092c9ccd498bb726988d5830f72e6f09b3f2cbe118cc896d94a659f
SSDEEP 768:Md4bSV4b+8b4bm254bRWRmG4b/QB4bH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3c4g:M2u+68si2y1WRmlzQqju1jaKDILpZ8U5
TLSH
T17DE23A3B280CCB7E4F844E5CEC26AF966ED802CB56684D5447FE494C03C77EB511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b31565322ba1fa7ec6bf032901427158ac556c6d4e916cd745eef40b95a53818
MD5 5f6595b49be3f183f0a4be7b0053723d
SHA1 180c3f36116759685a19bf4dddc3e6c17cf4f70d
SHA512 88f797da0ec1c2577ce57a284ea375eaae4ff3dd93926539e6aad92a8f93b05dfe09ff6b15f67f7bcb9496e1e6c5d755ed19cfb4690c5d61e7e528db5d32c01b
SSDEEP 24:KddfYrCaHdvLj47/+SIjXjKisha5j1EhfsX+a7djP34HL+uIjL3KighaV31EBnSz:K8KIvKLS/+I3KnKIvyB8IvK5ekZRItKc
TLSH
T1F5916B6370BE12213D7D250CA390A7764A42F2A33498E83B77B808B51D67E601CFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57921fb9-b444-4bac-951b-f33ff630143d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\57921fb9-b444-4bac-951b-f33ff630143d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d1201d7974ca5326bc199f8559e425b1c65c90af3d6d3b010a6f3379cbbe54f3
MD5 cd351f7a7b083d88965552f51c61c5e7
SHA1 1480ba8fac7a058d290551dd0df9df9598a25cb0
SHA512 0a02269304f004f2ca3de4a13e76e6322a0ab2ac9b2824c95b92f71cb161e34a9b23cedd229167424116940ac413d205eab3613d5cafac2c7dd31e6e59f8be64
SSDEEP 768:vFH4wDwgdPkrpnKQfCJKLtrAo4KCM3ZU4:p4wSCJCAo4g324
TLSH
T153C23BF248E7983AD9AE5743B73E3D128EBCC067B5845A40B7D8961CCC561BFC306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f37549e0cb9a89e65b20939654173b5a53c448142a5ca10285b163f25b8f3abb
MD5 934550b87cf4decb596fb637a8522f5a
SHA1 a4fbdcf7d9b3f6b91dc384082cff91fe586db4c9
SHA512 24908522f49e2956ab9281666c4f5f55e87b5331690e8953d9cd5ea18253cb244909eb48a877e2e5a9ed3b81ac6eb84b7e8375d5b825e12f3f8cec29d0d026f4
SSDEEP 384:cZcIN8Nnx3AWJeHwr3b+AH8EyXQVCJKLtuMAo4gh9CM3ZU4:KNwCxkrpnKQVCJKLtrAo4KCM3ZU4
TLSH
T1CD927D315C74AC7B1DEBA582B94732238FF4807796C82F80DAFDAB1C059A59C130AD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 799b9f93465222b68b496def6d34e2ff1c98cb13fd5b2059cc6f7e5c5765c4e7
MD5 9c75111c2dcac09ab6504741e69a7c49
SHA1 d283a58b03afc24f61362b6ebe6806aef69a9a64
SHA512 856bbb44d65ca548f574f8ed58692a07473719cd13d45e42a3ad38afa1a6bde9ec850191b7b4dacddb804247487e55e9aa4f8966ebe2158f01f09d8d38cddc9a
SSDEEP 384:xZcIN8NnxLAWJgHwr3b+AH8EyXQ2CJKLtuMAo4gh9CM3ZU4:ZNwC3krpnKQ2CJKLtrAo4KCM3ZU4
TLSH
T112927D315C74AC775DFBA582B94732238FF4917796C82F80D6FDAB1C059A68C130A91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9035921e7a25f9b21e42c32459d455e04bbbf0e4fd1b4ff15f30a76251c1e697
MD5 fa41739f353d5873e272fe9ea0fe9bd7
SHA1 aea7a3baff298777ba9cf6e604f7dd4c75fc920d
SHA512 d727385ab1a3e46ec713fae9498d4bcfc9aa7e62344ef7a21bae5e781afaae7fa4d2f2aca8ec6a95d0f9de7e13cd8f977a5566493d437322aa59d2df7ccf7114
SSDEEP 384:+ZcIN8NnxEAWJgHwr3b+AH8EyXQ2CJKLtuMAo4gh9CM3ZU4:8Nwh3krpnKQ2CJKLtrAo4KCM3ZU4
TLSH
T18B927D715C74AC775DEBA582B94732238FF4906796C82F80D6FDAB1C059A68C130A917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6b3f7c3b36d8994cb47a504fa3fce41415f2466eef1e40ff6accea7857c8e7df
MD5 22902d8bc01aed8b51b8c617919932b3
SHA1 ad8ced10ba1506c39cb7cdd7667d30d3f9b5fc54
SHA512 b18b462ba7d2ff377dda5a25896ae536df30240fc7655ffe85c1f1fb1b491a8f777ed9df71f5ca28ebbb3a0994b8bbd371dcc9c6726308db517daf7590a6cf98
SSDEEP 192:nRGNU6yMQmiUyjJmt1Y3b+jcfjzorrHoAgMnCNCU6:RGNU6xcK1Y3b+AH8EkC0U6
TLSH
T16802E835A9786CB79EF26E45B98737138FE4117BD9912F80D6E82B1C00D764C234B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6206d991e2c4732eb921d42d7b15c109b70ef3c7576e23d5a1c813102280e317
MD5 684910a92a96da8b337d22fff7c4b1b1
SHA1 dd188459c59da08620161b4226bb7739d3b4841d
SHA512 d319957398f07e108dab2c67929c12ddfd1bbcaac9ababc5cba2bc95432b18c89c94f2efbc00273aac47bc02789b521d997fc0a0d2f8f466d664027c7c011c60
SSDEEP 192:PGNjg6ywQmiUyF0twY3b+jcfjzorrHoAvXQri4MCIrqLU6:PGNjg6VjwY3b+AH8EyXQmCJU6
TLSH
T1BE120932A878AC7B5ED26981B44731138FE51167EA857F90D6EC3B1C04DF65C234B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6d7d0f35-1455-4de0-9afe-b2f019d3e7bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6d7d0f35-1455-4de0-9afe-b2f019d3e7bb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download