hxxp://ctwork01[.]biz[:]443

Analysis

user interaction
yes
max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 12:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://ctwork01.biz:443
Sample260804-p78xfaxtft

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3860	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303219734087522"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{15F0DA98-B342-4529-B2AC-3BBB02D9536A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4688	msedge.exe
4688	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 4812	2296	msedge.exe	86
PID 2296 wrote to memory of 332	2296	msedge.exe	87
PID 2296 wrote to memory of 3860	2296	msedge.exe	88
PID 2296 wrote to memory of 332	2296	msedge.exe	87
PID 2296 wrote to memory of 332	2296	msedge.exe	87
PID 2296 wrote to memory of 1528	2296	msedge.exe	89
PID 2296 wrote to memory of 1528	2296	msedge.exe	89
PID 2296 wrote to memory of 2988	2296	msedge.exe	90
PID 2296 wrote to memory of 2988	2296	msedge.exe	90
PID 2296 wrote to memory of 2988	2296	msedge.exe	90
PID 2296 wrote to memory of 1124	2296	msedge.exe	91
PID 2296 wrote to memory of 1124	2296	msedge.exe	91
PID 2296 wrote to memory of 1124	2296	msedge.exe	91
PID 2296 wrote to memory of 4472	2296	msedge.exe	92
PID 2296 wrote to memory of 4472	2296	msedge.exe	92
PID 2296 wrote to memory of 4472	2296	msedge.exe	92
PID 2296 wrote to memory of 1876	2296	msedge.exe	93
PID 2296 wrote to memory of 1876	2296	msedge.exe	93
PID 2296 wrote to memory of 1876	2296	msedge.exe	93
PID 2296 wrote to memory of 3508	2296	msedge.exe	97
PID 2296 wrote to memory of 3508	2296	msedge.exe	97
PID 2296 wrote to memory of 4968	2296	msedge.exe	98
PID 2296 wrote to memory of 4968	2296	msedge.exe	98
PID 2296 wrote to memory of 1692	2296	msedge.exe	100
PID 2296 wrote to memory of 3892	2296	msedge.exe	102
PID 2296 wrote to memory of 3892	2296	msedge.exe	102
PID 2296 wrote to memory of 3892	2296	msedge.exe	102
PID 2296 wrote to memory of 2092	2296	msedge.exe	103
PID 2296 wrote to memory of 2092	2296	msedge.exe	103
PID 2296 wrote to memory of 2092	2296	msedge.exe	103
PID 2296 wrote to memory of 4160	2296	msedge.exe	104
PID 2296 wrote to memory of 4160	2296	msedge.exe	104
PID 2296 wrote to memory of 4160	2296	msedge.exe	104
PID 2296 wrote to memory of 2136	2296	msedge.exe	105
PID 2296 wrote to memory of 2136	2296	msedge.exe	105
PID 2296 wrote to memory of 2136	2296	msedge.exe	105
PID 2296 wrote to memory of 4392	2296	msedge.exe	108
PID 2296 wrote to memory of 2212	2296	msedge.exe	109
PID 2296 wrote to memory of 4808	2296	msedge.exe	110
PID 2296 wrote to memory of 5056	2296	msedge.exe	111
PID 2296 wrote to memory of 5056	2296	msedge.exe	111
PID 2296 wrote to memory of 4688	2296	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ctwork01.biz:443
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x288,0x7ffdf873c188,0x7ffdf873c194,0x7ffdf873c1a0
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,14676507142940357161,768423831508717134,262144 --field-trial-handle=2188,i,1312846747491486601,4044692522358460107,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,17808287147724697068,9916677538876402935,524288 --field-trial-handle=2188,i,1312846747491486601,4044692522358460107,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,5739343255733917255,10595850453716633619,524288 --field-trial-handle=2188,i,1312846747491486601,4044692522358460107,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,4702577556475983179,14419231293267577751,2097152 --field-trial-handle=2188,i,1312846747491486601,4044692522358460107,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,1708618473854666446,9958010884824154644,2097152 --field-trial-handle=2188,i,1312846747491486601,4044692522358460107,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,12779340539243074764,7672169848210634902,2097152 --field-trial-handle=2188,i,1312846747491486601,4044692522358460107,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4156,i,3963902341231942250,15604173179617919379,2097152 --field-trial-handle=2188,i,1312846747491486601,4044692522358460107,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:2
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,7292621731834940122,5021740687645548656,524288 --field-trial-handle=2188,i,1312846747491486601,4044692522358460107,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,8267249457256969003,9228094931471845585,524288 --field-trial-handle=2188,i,1312846747491486601,4044692522358460107,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,11252691981514764625,13603808486512661171,524288 --field-trial-handle=2188,i,1312846747491486601,4044692522358460107,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,11252691981514764625,13603808486512661171,524288 --field-trial-handle=2188,i,1312846747491486601,4044692522358460107,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6332,i,2275550622659132267,15782526835017751395,2097152 --field-trial-handle=2188,i,1312846747491486601,4044692522358460107,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6164,i,17794267494735424713,13751149537541063747,2097152 --field-trial-handle=2188,i,1312846747491486601,4044692522358460107,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3724,i,4826632132892241373,75939136570953150,2097152 --field-trial-handle=2188,i,1312846747491486601,4044692522358460107,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6392,i,9701708986334508987,7126288331821491152,2097152 --field-trial-handle=2188,i,1312846747491486601,4044692522358460107,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,1468007050101918344,6035536835142075312,524288 --field-trial-handle=2188,i,1312846747491486601,4044692522358460107,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,3968213756360669409,4278982479380525514,524288 --field-trial-handle=2188,i,1312846747491486601,4044692522358460107,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,10865012224684143082,3449510736154893071,524288 --field-trial-handle=2188,i,1312846747491486601,4044692522358460107,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3968,i,16441135018129340577,4468819437246933284,524288 --field-trial-handle=2188,i,1312846747491486601,4044692522358460107,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5836,i,14237153391115367552,499696153151823600,262144 --field-trial-handle=2188,i,1312846747491486601,4044692522358460107,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 17d500b4417e92837c05a8187f43f060e09191612c25892f2c54e786bd254c36
MD5 ca52a84f03e904e79c2a5651b273e5fe
SHA1 61ddeaf1850d81986389db97ff9470b67eb8cb1d
SHA512 d1f489b74d4da21280e354fdfd91d6569edfcb1abc7f4f6740756bbe744f02bd51136d5ea47c7a6a1842683dc3eba0d2608d4d46e5eb8ffb5035ffeb98f9c788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7G:fwUQC5VwBIiElEd2K57P7G
TLSH
T1B9B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 195ba8ebd954821c0e423d0354aada052ae04a340403b05e7c40638c19a170cf
MD5 3d17954c8babf5b76d59ae1037ea411e
SHA1 53bc91d71f7b91bda1d1368e7eaa4f89c6fa8ed0
SHA512 2c52a4b24efd69607ba4135975345de57110f14f85bd2b300b8f8db837111ab77f2a5341c1d56f367e85d9684e07cc7ed08656f3ccda592f041163ed2dd346c5
TLSH
T14E6119250302065CF3319372E6F31D65F9FC81D54B6F8E867092297E7639B63481043C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589287.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589287.TMP
Size 3KB
SHA256 ecbedc1e8669eb16be356d4a39d43acb50dfc4e7d2370dcda8067bc8c2773acc
MD5 8c2e0e70926872a5ed5354d20b45be26
SHA1 6e404bb7f39cb2f259289e3c004f37b5abbed6fa
SHA512 5f356acd5e45ff55ab8d1735d7bedaf119b6e1e85734b08ed5bb587e50c1e1b99615b2cb99310806755c8237ab764a4d7c33e84b7c825c157607a2423c0640f3
TLSH
T1A061F8250302065CF3319372E6F35E65F9FC81D51B6F8E46B096297E7639B63481143C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f9c5d0ea7ad00d42233171ab4c1ba131337fb93d1e41197af8c7ada28776d16c
MD5 20334ba0de14ea9ea7f0ac00499c20ba
SHA1 b8291e9846ed7077ebd795929f6f651ddaa37d54
SHA512 aa5fc21aec3be978c54a978a8a57fbf919611d172d20e7470daedddfb572c9e845f2ddee7ec9fd482b81531628c435546933b45f2f119c2cac3a5093e68f8c23
TLSH
T1C4219DF3C7E5956EC91516F05A28BE1BCE1C0A05421C3C69C5D4EF2BD7E2035E00295F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 23aea699571c1f5a09c59591333e78d8c1cd6541514213361dca8d8cf035e91b
MD5 6c32d1b5c84dca6b150423202e39db89
SHA1 17725b344c6794670502826756619013dc436f94
SHA512 a0937c5b7bca3c36bd1e9968881218409bc9464241169265d2f908ea11e408a2a7df5e2f6dba975f8865501b183b962dd0bdecc522e6278645587e64d6170d05
SSDEEP 192:sxZ8RxyM/jK1Ml8Mkq/flsRt2PIdpJHW6+WNGYHltAUIgrJ:sxZ89Mq/flsR8gJHbGi9
TLSH
T15942F7126B34A977CCCBD20DFA557F43D6F51572A2900E44A9FCDA1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4f58af5bda309e14fdb43c2128668b03dbc92ae7b2385b3c2e6ea6c80b837739
MD5 4d457541dc28cb2dbc47a7faab6220f0
SHA1 92a692adc9e5fb26f5355c8c908a596b73f0013b
SHA512 c9a114310b37857414f1b475de3d4f154db55862d32476dbdf500eabcdc85e3051f4a9adbf4f6ba4dec175eb77697e331b2ef9691d08590c80b4db4463e1f464
SSDEEP 192:sxZ8RxyM/jK1Ml8UQakq/flsotbKIdpiQvHW6+WNGYHaAWUIg5DJ:sxZ8/qpq/flsoZDlHbGCT
TLSH
T10C520712AA389977CCDBD20DFA517F43D6F51572A2900E44A9FCDA1C00E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 519163d3cfed769b564d4bec219a34c37abe22448461c9c622195418e39fdcfd
MD5 81a5fc57674fd7dbf1e04b016911e302
SHA1 7fc9bed8115980719cd9c57d0d4990bf0b9bf1b2
SHA512 8536d31e8991713f937d08f0b7090fb66812df761da9893c3265dfd09fedbd3c74d3f087a9d0f0aa2245a03727c09b6fcd2aa71abdda1be878b26fa378a2657a
SSDEEP 192:sxZ8RxyM/jK1Ml8Mkq/flsot2KIdpgQvHW6+WNGYHjtAUIg5ZJ:sxZ8/Mq/flso8DPHbGGd
TLSH
T18D42F712AB34A977CCCBD20DFA517F43D6F51572A2900E54A9FCDA1C00E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 3ee33835eafd12263ffae265b3c147f68e7a8a9ad3006c6e10a8141624544883
MD5 ded3745531ece3aefb04a141ca2a789f
SHA1 51dfc8bdae821c797bd0c1dec244044355ad52ef
SHA512 5782c90e6acaf8a603990b827eba64a14147e97dfffde1261321554dee5bfddee2f09ae439b9e55ad0ced6221448c183eb3606718b24535eb1078dc4b07e559e
SSDEEP 768:KBUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RhroV40v:KBUZYTMWvg0Pou1ja7eLZmRapv
TLSH
T146D20B3B284CCB7E4F844E5DEC266F963ED801CB5A584D5447EA884C03CB6EF512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 47463878968a99cdf2582f7f011d0c4333f3b7d62c8cc53f48d90a7d14f84e89
MD5 29b1bdd025fa701bdee48322c6ac1ba0
SHA1 febacb3b956e75a276eddb732f0a9784e2d4314f
SHA512 add747903cd7e92b4647379fdb5827d986df444c2fcaad59c378e5019ac33ee4ad5198a2ae9dc91847d22a0e3aafc806fb1804cbb4e9f1f57c5c0353277e6e93
SSDEEP 96:KA1eK2AkWcKjCGm7mKM47iQKDKq25mKy4y:EGbdzHFT
TLSH
T11BD11A5270BBD2123C3D2B0892D59766DE81F1A37018A4AB7F6D11B18E2BD209DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81368bdf-c65b-48fb-a605-d15a40788117.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\81368bdf-c65b-48fb-a605-d15a40788117.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 19640e8be7b18bc929a6e8660841fc04f23c505a8e2d8b9e41dbcda5c72b7a72
MD5 ee31f3a83bfbe4239a3f49828fac02e0
SHA1 4218339d31907ce6e0c119a859c21060598d7de4
SHA512 884a4505c087cddae1ea6f96efe9a35467439a20358f317167b7a17c158f0e89311ef1b385a4fc7abe3ea2ef14f9dab75ba08b900b1ace0904dc2819ecdec10a
SSDEEP 384:NZcIhsNla5MnbpKp6zX5od+ndiV+DtJrXwBeRs9JKgqijUrMhOGx:VhR8CuOOYChXwTjKgqmUwhOGx
TLSH
T17E927C315834AD3B99E7F986F48736134FF49067EAC43FD592FDAB0C019A5AC031A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 33354cdd159d18de93ef7155a63ed0c03411e8d6b490efad1f8a97d481c5345f
MD5 bffcf61b3f5d08c220920f27ef5fa3f5
SHA1 227f3fc3a21d99bdcd252e7375c5ba6173bc80df
SHA512 bf29b3231216b17a095f66ceed5b7e1f9e3f3baea0cd30ea6abef7a021fbffde92e09f3cad01f2fbad44c8101d2361c3ad759eeca0cc88e8ddad8b7c8a9b4426
SSDEEP 384:oZcIhsNldMnbpKH6zX5od+ndiV+DtJrXwBeRs9JKgqijUrMhOGx:WhvguOOYChXwTjKgqmUwhOGx
TLSH
T16E927C315434AD3B99E7B946F48736134FF49067EAC43FD492FDAB0D019A5AC031A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9397e9b5264e9b9b9277d1ca973399008da64d2818921a47181bbb312f24aa78
MD5 22f829f7133a65348add286a2e7ab150
SHA1 65990c3367220a283b515462baf862c17323f2c4
SHA512 d847c4d7c372aadd60d660b4257c32b3c393f767dcee8f7ac20a047d9a17787132ccca19d7f3139f63f1e4d704094af5c6a2136d5e08207306e26530eba38c6d
SSDEEP 192:yONR61VWQmiUyJkgGX5Obd+jA+Fdg3ao+j/aD3jsU6:yONR6W/gGX5od+ndiV+mXsU6
TLSH
T19402C73569687C67CEF2BE4AF48737135FD52067EA952F84D6EC1B1C009769C2306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 62138bafe236faed4a0efe0ff2f2d8d03e7938660735885ca52b6fa837140ea5
MD5 33d03b5087006c58b2c317deeed5e50b
SHA1 041b3bb233f4797126bb8d79ed71462dbad7791c
SHA512 6b932fb246d055dbfbfaab2a38ccaab3b03f139688a8bc0dc7ce3434f82eca099fbb5ef2fcd4aedfc7bb0372b81b64d6c8a48e98adb4e2c4b56c6af3318bb4f6
SSDEEP 384:6iFiZcIuzsN/8TUNTUlIldMnbpKH6zX5od+ndiV+DtJr1wBeRs9JKgqijUrMhOGx:xFQuCwgOguOOYCh1wTjKgqmUwhOGx
TLSH
T1D7A26C324864993BEDF6AA45F58632038FF59067DAC4BED5A3EDAE0C00575DC030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 180ad62e8a2d46fb86c0ef5a911729795dfef3b1eca94c4b6dd322d1c4fcfd53
MD5 04d16a7dd4bec5b63b8a3addfbbca913
SHA1 dd377836d25ad47f74652ccc172cc4873deaabf1
SHA512 adf9e99b744873ea7e261dbbe9b47f944084e38781103c4f3495806c975c6b3671d55a0f00a5fcb2ce260bd8928361dd19387015f564900e17fe067b2ddcc608
SSDEEP 192:4ONo61uWQmiUymkmGX5Obd+jA+Fdg3ao+d1ySJrWjJlqFU6:4ONo6PamGX5od+ndiV+DtJrywU6
TLSH
T1DA120A316468AC6B8EE2B945F48731535FD55167EA897FC5D2EC2B1C00EB6AC130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3aeece16-c2ce-4f21-a31f-572e6ed30901.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3aeece16-c2ce-4f21-a31f-572e6ed30901.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9938c05e315028b6f2c7307a02f65052aaac87c29db237c49d10a914dd2ac26f
MD5 dda64f773eba996c6f8d126f9ce57b65
SHA1 d6265e5d7e5fc433f369d4df79b8054b3621580f
SHA512 6596da7c14ece32060f5e101dec93f1eeeb41534a46d774daf53b0f305fac114cb90dd5e4bd319c633061706f4711ead06d32ccc9b4dbca098c229b4cc711072
TLSH
T1BF413258A6F92148B3B26F06AFF6B46E487BBD372E0A949E00000D4F0662E40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download