hxxps://hrdattestation[.]in

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://hrdattestation.in
Sample260806-pctt2avvbx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2712	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304918997964184"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{4598A8B7-2525-4FBC-BD0B-C620F3C66575}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 3224	4004	msedge.exe	85
PID 4004 wrote to memory of 2712	4004	msedge.exe	86
PID 4004 wrote to memory of 4592	4004	msedge.exe	87
PID 4004 wrote to memory of 4592	4004	msedge.exe	87
PID 4004 wrote to memory of 4592	4004	msedge.exe	87
PID 4004 wrote to memory of 2000	4004	msedge.exe	89
PID 4004 wrote to memory of 2000	4004	msedge.exe	89
PID 4004 wrote to memory of 2396	4004	msedge.exe	91
PID 4004 wrote to memory of 2396	4004	msedge.exe	91
PID 4004 wrote to memory of 2396	4004	msedge.exe	91
PID 4004 wrote to memory of 1676	4004	msedge.exe	90
PID 4004 wrote to memory of 1676	4004	msedge.exe	90
PID 4004 wrote to memory of 1676	4004	msedge.exe	90
PID 4004 wrote to memory of 4304	4004	msedge.exe	92
PID 4004 wrote to memory of 3860	4004	msedge.exe	93
PID 4004 wrote to memory of 4304	4004	msedge.exe	92
PID 4004 wrote to memory of 4304	4004	msedge.exe	92
PID 4004 wrote to memory of 3860	4004	msedge.exe	93
PID 4004 wrote to memory of 3860	4004	msedge.exe	93
PID 4004 wrote to memory of 4376	4004	msedge.exe	98
PID 4004 wrote to memory of 4376	4004	msedge.exe	98
PID 4004 wrote to memory of 3716	4004	msedge.exe	99
PID 4004 wrote to memory of 3716	4004	msedge.exe	99
PID 4004 wrote to memory of 4084	4004	msedge.exe	101
PID 4004 wrote to memory of 976	4004	msedge.exe	107
PID 4004 wrote to memory of 976	4004	msedge.exe	107
PID 4004 wrote to memory of 976	4004	msedge.exe	107
PID 4004 wrote to memory of 3936	4004	msedge.exe	108
PID 4004 wrote to memory of 3936	4004	msedge.exe	108
PID 4004 wrote to memory of 3936	4004	msedge.exe	108
PID 4004 wrote to memory of 4196	4004	msedge.exe	112
PID 4004 wrote to memory of 3512	4004	msedge.exe	113
PID 4004 wrote to memory of 900	4004	msedge.exe	114
PID 4004 wrote to memory of 4800	4004	msedge.exe	115
PID 4004 wrote to memory of 4800	4004	msedge.exe	115
PID 4004 wrote to memory of 4800	4004	msedge.exe	115
PID 4004 wrote to memory of 4704	4004	msedge.exe	117
PID 4004 wrote to memory of 4704	4004	msedge.exe	117
PID 4004 wrote to memory of 4904	4004	msedge.exe	118
PID 4004 wrote to memory of 4904	4004	msedge.exe	118
PID 4004 wrote to memory of 4904	4004	msedge.exe	118
PID 4004 wrote to memory of 5004	4004	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://hrdattestation.in
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x268,0x7ff95576c188,0x7ff95576c194,0x7ff95576c1a0
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,17306419733618278589,16597087728201175341,524288 --field-trial-handle=2292,i,14067346537034180533,8614448189866875539,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,7826797247532617823,7062522449716737505,262144 --field-trial-handle=2292,i,14067346537034180533,8614448189866875539,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2652,i,3781665029783671315,540386651107517174,524288 --field-trial-handle=2292,i,14067346537034180533,8614448189866875539,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,8577672205740485738,12513466922840117269,2097152 --field-trial-handle=2292,i,14067346537034180533,8614448189866875539,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,9995935552938445373,7412530833430973970,2097152 --field-trial-handle=2292,i,14067346537034180533,8614448189866875539,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,243190561288804059,5326072288828033676,2097152 --field-trial-handle=2292,i,14067346537034180533,8614448189866875539,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,9637961787379142791,11911058932507847611,2097152 --field-trial-handle=2292,i,14067346537034180533,8614448189866875539,262144 --variations-seed-version --mojo-platform-channel-handle=1640 /prefetch:2
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,9055867964317923204,10140348560302260097,524288 --field-trial-handle=2292,i,14067346537034180533,8614448189866875539,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,14861006573943630516,10320075412820759608,524288 --field-trial-handle=2292,i,14067346537034180533,8614448189866875539,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,8926230022947760743,542995282982603242,524288 --field-trial-handle=2292,i,14067346537034180533,8614448189866875539,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,8926230022947760743,542995282982603242,524288 --field-trial-handle=2292,i,14067346537034180533,8614448189866875539,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6240,i,4018500970974840403,1616246069321784614,2097152 --field-trial-handle=2292,i,14067346537034180533,8614448189866875539,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5880,i,3615672130490210652,2394826381605690708,2097152 --field-trial-handle=2292,i,14067346537034180533,8614448189866875539,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,14980046051541517695,16370582301206000769,524288 --field-trial-handle=2292,i,14067346537034180533,8614448189866875539,262144 --variations-seed-version --mojo-platform-channel-handle=1640 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,2036817706973324980,3797207489457749173,524288 --field-trial-handle=2292,i,14067346537034180533,8614448189866875539,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,6073918637969330602,11173720180118909775,524288 --field-trial-handle=2292,i,14067346537034180533,8614448189866875539,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6420,i,9157715546777154300,9622349032492553900,2097152 --field-trial-handle=2292,i,14067346537034180533,8614448189866875539,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,9292586713578671130,2161691886103043026,524288 --field-trial-handle=2292,i,14067346537034180533,8614448189866875539,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5828,i,13581566875086335250,6988463360520911730,2097152 --field-trial-handle=2292,i,14067346537034180533,8614448189866875539,262144 --variations-seed-version --mojo-platform-channel-handle=1052 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6080,i,14264008380849067771,7889411259059021500,262144 --field-trial-handle=2292,i,14067346537034180533,8614448189866875539,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 44706d76f1ece5a4d450e10d3b99aaf6820a25cca350bb58e108f0eb115cafbf
MD5 e3ca4a53a76897ebcd14d64f6a91d351
SHA1 02ab68c2bc82cd6a3f6b7d691753996336593f0b
SHA512 449237f2d46cb6821e353c75c34e76857d89b96f47ae72e02f02c026193c256f1ec96ce821516fec0eede00a9e60c3f50b24c42e73da1cdebd39d67dd09fa676
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7B:fwUQC5VwBIiElEd2K57P7B
TLSH
T1F4B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8575ddbe26fd4fd935add2bfbe1485e169525be451e883bb4ec97c98cf981e2f
MD5 124a32c53f744aa6112e48594cdb7f98
SHA1 10bedcb9354ebaf9d718d8b1ed89c2182cf33d4b
SHA512 466f33cba5670c97936504afd6fe4257d52ea416ec2ad79829e293b16d9d90da2dee2f3165cab0aebf7457575b92465ccd829a4fee43c31fe96e009c2c500d8f
TLSH
T15571816507523461F3DE3131A2E206CD7BF38C850A9FDF3742232BF92B267218A79818
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585e77.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585e77.TMP
Size 3KB
SHA256 408c860fb6bb91f4e22dbff34dc093448d7f3baabf8bf94b5778efccf2629d2d
MD5 0e420281fd7238f1f930a8ec93dbd1c5
SHA1 ed9d501468225f5159ec479ca71aea9aaa337686
SHA512 c2e84fca71bc14b375101dec11f530dec248e89ac922bbff680efdf4bf6f08cd1684b47f61f8c5afee17534c8545395de5ef6597590ca84f8344316d058ef5a1
TLSH
T1F371526547523451F3DE3131A2D206CD7BF38C85199FDF3746232BF92B267218979818
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 3265d1547a74422e0ac3fd3361462b48f390523e4599d24dd38793c6e0fc2464
MD5 81d7c01d3b1905da58dc6e45ab12f5ea
SHA1 7d49f69783b689b3a9116d0e58b0c60c80d64c15
SHA512 bd1ee35cc58914220ffc9514dd786878920e8d3efe111df82750d25bddc91060ca20ce79ca937b61572473cae9abbbc84329e9277d169dd883e1d744ba44ac43
TLSH
T14E1157F3C7D5856E8A1156F06A28AE2BDE2D0606431C7C698AD4EF2BD3E3065E00255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b125b960bebe43fed56973bd1ffbac18c6a2090ef2f067ac9f1befa3ea03faae
MD5 1345b105ed62b5597799718cfcce54ca
SHA1 b7f12db73a146cbd18ff0b362d27d2713e9048de
SHA512 8f017a71eb11ed77133d032a492b78011daaf1683bea7ccfa9882130d5e90815406c1807d7f0e1099f236db2653e18bf053d63edd7c02376f29d78a48497887a
SSDEEP 192:sxZ1bRwyM/jK1Ml8UQNk9Z/fdOXsPlmMIdpEaHW6+WNGYHIeV/1Ig5UJ:sxZp6qmT/f6sPlgLHbGj0e
TLSH
T1B452F712AA385977CCCBD20DFA557F53D6F54573A2900E48A9FCDA1C00E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 44f1562fce275b2665e47a1cce228eede23c9a671ad882f104f4db5f35dacc41
MD5 ea2c2f8cddc92ba66bc7ad535dffe0e5
SHA1 94bca7dfbf58a263785bc9b1f7294bbd3feeb06b
SHA512 cd03e31d79a36c3d3b76a9a0aae3ff3c64830f0b90056fcab66ca3ffb11a7bd3a78fbb5eb45d47c69bb647df6e13a320ea500a4e10ba42db34e105f1f7d78b61
SSDEEP 768:9QUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RbroV90G:9QUZYTMWvg0Pou1ja7eLZmRokG
TLSH
T12AD20B2B280CCB7E4F844E9DEC2A6F963ED801CB5A584D5447EA884C03CB7EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 eada231e0f61efb698cd8f3748845968512fe42f540cce3108a14193a36a997f
MD5 de6de9bc80543a6924e7146784861fa0
SHA1 cc4ad09c329f3a4eb63fd5e8e127cb413b696988
SHA512 108e4f17e4536722ec6183fe62c53ef559e79f856e9892b69e1c2b5f5778b44d165423666e9da863515f78ef450f4ec8e2b335af19c46ee6135b8ba5dd96b06e
SSDEEP 96:KA1eK2AANKK2IKiSIK/KcGMKvqK2jWKcgbecKjCf:E0RXs31D8
TLSH
T112E1291271FA62413C7E6A08836497168E42F593302CA86B7BAC65F14D67E209DFFCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c4de8705-2ed2-4df7-be40-dc1b18be96ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c4de8705-2ed2-4df7-be40-dc1b18be96ff.tmp
Size 12KB
SHA256 37d3ddb3ecfa4976039379d77579d8cdbdf7b36345eeba7dff84b748912cc3f5
MD5 d766325e8bd75142005edae5714a973b
SHA1 366c32d542e564fdf7b4e3d19f336d2ce7d47583
SHA512 e09826108fd65468e422ea5d2d0de37bfcb93f8ebc768d1733d570b25365a6f558a6a9471705baa70c6063ec0364ad7125c060a8d69e1c99291b2b531281e65b
SSDEEP 192:sxZ1bRwyM/jK1Ml8Mk9Z/fdOXsd+pMIdpJHW6+WNGYHlyy1IgrJ:sxZp6MT/f6sd+DJHbGQ9
TLSH
T1CD42E7116B38A977CCCBD20DFA557F43D6F90572A2900E44A9FCDA1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb496355-6207-46ae-a6f2-7e41ac48a58f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\fb496355-6207-46ae-a6f2-7e41ac48a58f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 8cf5776b042ead6ca4a19f4f7152b991ac82c84122b701d1c70f6437c2d18646
MD5 223a9e2b9789813203383d67b835b213
SHA1 f372d14cf766ce0104cd6a0d59c2284f7883d8ed
SHA512 a46825e0694ff07843e80cab1a9a6011f1f32d519aadc31d0fd9f10225435ec144d0fc8c8f434f15757644b166bd261247838e77aa0324cfa52c5036de411416
SSDEEP 384:zZcIhsNBkkEaiyzX5od+ROwVMwHnTKwBODNZOCa5id:rhHGOwOEMwHnewBKZOJid
TLSH
T188927D71A8386C738EE7F549F94731078EF89177E6843F9496EC7B1C00AA598231BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 4cf1713e629c12990b02fdd0859dc10a684e80ec1af4b3367723ec3938257966
MD5 158b26aaaff444f1c2c1a7e7a0215a7d
SHA1 eb9aa406ff66f9e17105013fe227fdb6e39d7bc8
SHA512 b051b08221cee101ba432529ec3666f50de13bdf20f5e6a56a16445b84f6d293d717e57186398e4abcf963ee860eaaa85badee1c34de0d258d57a9b977a1844f
SSDEEP 384:GiFiZcI2zsNT8TUNTUlIlOkEaiyzX5od+ROwVMiHnTKwBODNZOCa5id:tFQGWwgkGOwOEMiHnewBKZOJid
TLSH
T1D3A27D7398289C77DEE7EA49F94A31038EF491B7D9947E94E3DC6A1C00961DC130BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 219006026cc54d938ba1ea23fed4ba22142562333aaff5d3bddf7239efc97fb3
MD5 7ae69288536834a446c49cd5e932a5bf
SHA1 72dd696e0cbcc132b31bd7b698da617b5cb08e48
SHA512 c54fab451ab4cf95ec2f3bf505c446932bb6ac1c02c9f0fbce0bcd88daf3f6b729d43bcee2cc558f1baabaf76bf54e016664876486ca5432b608168deeb483e9
SSDEEP 192:yON261VWQmiUyP5gGX5Obd+jtOwaojD/ae3w4U6:yON26WEgGX5od+ROwVyR4U6
TLSH
T18602E835A9286CB78EE2EE4AB58737135FA92067E9542F84D6F81B1C00D769C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4f9d2bca2e4b4bead3d628049d0a8b163488abcc20eb5bd339804b640a254090
MD5 c2e13310a3a07183c60c966e93e176f1
SHA1 17a7bfe1638ef8f0f3e8b4a1e9ab65ce79176ba8
SHA512 6418c306a8dedec5d37d7b07a504b2239581d5fceb364fca5c8723bfd8fb44f8e314efe53ca87ae9c7b12475312fd7e153bca7db749249b6f998a71d3ee796e8
SSDEEP 192:SONc61HWQmiUy05uGX5Obd+jtOwaoj4E5jJenqrU6:SONc6YtuGX5od+ROwVMuHU6
TLSH
T1D0120A32A428AC779DE2E599F48731538EA55167DA847FC4A5EC3B1C01DB6AC230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 b3286c0fb84c528911a12fcdb407ce0023cf8cf5af3c90fcab60913cfbcace1b
MD5 8c30252a242f79de79de312e59d71242
SHA1 bdb47a12879ec6d78308cf435172271fdf6e4f38
SHA512 6e98b95e97657d7e00d82bc537900b014574dd6e9df8fd49a93e48cc7de6252f16e3753ad43e7d767486e01c52d9ba529818dc91b09e84ff814778c5a6acf969
SSDEEP 384:EZcIhsNBOkEaiyzX5od+ROwVMwHnTKwBODNZOCa5id:ihvGOwOEMwHnewBKZOJid
TLSH
T136927D71A83C6C738EE7F549F94731078EF89177E6842F9496EC7B1C00AA698231BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7b99012ce18a85a8540b6998946cd6e890651c3955ebdda9259eb64837554cbe
MD5 25b24b19592694a6bb14fcf5b2b4075d
SHA1 9b85399b8af36c4bc8b370ed49cccff648d721e4
SHA512 04e207c563871c50b0214355eadd66e3fc75b83d992d1647c82a941eb790958830e19d75b9a71b2982f1fde406b71a0fdced757515adf70bd4f4f65c13eeb13f
TLSH
T1F9412958B7ED1148B7B77F1A9BF668AE487BB8332F0AD45D00110E4E4666E40C8A1B33
MD5 SHA1 SHA512 TLSH

Submit Download