hxxps://chdv48hbb[.]cc[.]rs6[.]net/tn[.]jsp?f=001k2bZIstVz7S8Nuj9iLCVjOAlGm2dei5dpbLeKj7zRJbquKQj1GdC-BB7M4XUIkEaz5E5lqOfrbvG-QL6y256CMOIeFyuRsFFpeXhUGxHb2e7mpCSlqVYJNgfS8hKO8KyPyyq_dvS_LkCuaA1-8QOqTLWxp_AU9_ZYZFkEZmfuTMlsvlRuLYUZrJrmqxJtXpuoJ5S6symUt4uAUypk7Vm76ZXGuPNFrsLp_G-nZMnBtuwq5NddWUdUWIMdJC5UJ6SpGqeZuscmtk=&c=nHZPJPtqLrwsCb4oFkFBo3CpuqDgm4t9ckByeQHHsJ-iWw9MUMaCcQ==&ch=Do1apQpnUXFAnpr9PoR6AXiFMEjoT0-GQ4LJuwQuCGRxy2xU1v3Hng==

Analysis

user interaction
yes
max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://chdv48hbb.cc.rs6.net/tn.jsp?f=001k2bZIstVz7S8Nuj9iLCVjOAlGm2dei5dpbLeKj7zRJbquKQj1GdC-BB7M4XUIkEaz5E5lqOfrbvG-QL6y256CMOIeFyuRsFFpeXhUGxHb2e7mpCSlqVYJNgfS8hKO8KyPyyq_dvS_LkCuaA1-8QOqTLWxp_AU9_ZYZFkEZmfuTMlsvlRuLYUZrJrmqxJtXpuoJ5S6symUt4uAUypk7Vm76ZXGuPNFrsLp_G-nZMnBtuwq5NddWUdUWIMdJC5UJ6SpGqeZuscmtk=&c=nHZPJPtqLrwsCb4oFkFBo3CpuqDgm4t9ckByeQHHsJ-iWw9MUMaCcQ==&ch=Do1apQpnUXFAnpr9PoR6AXiFMEjoT0-GQ4LJuwQuCGRxy2xU1v3Hng==
Sample260806-ss613sel2v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2084	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305034709279831"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{35B43922-2A90-47D5-9F24-9FFD812D4821}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 1624	2444	msedge.exe	85
PID 2444 wrote to memory of 2084	2444	msedge.exe	86
PID 2444 wrote to memory of 2128	2444	msedge.exe	87
PID 2444 wrote to memory of 2128	2444	msedge.exe	87
PID 2444 wrote to memory of 2128	2444	msedge.exe	87
PID 2444 wrote to memory of 4036	2444	msedge.exe	89
PID 2444 wrote to memory of 4036	2444	msedge.exe	89
PID 2444 wrote to memory of 4928	2444	msedge.exe	90
PID 2444 wrote to memory of 4928	2444	msedge.exe	90
PID 2444 wrote to memory of 4928	2444	msedge.exe	90
PID 2444 wrote to memory of 5000	2444	msedge.exe	91
PID 2444 wrote to memory of 5000	2444	msedge.exe	91
PID 2444 wrote to memory of 5000	2444	msedge.exe	91
PID 2444 wrote to memory of 4284	2444	msedge.exe	92
PID 2444 wrote to memory of 4700	2444	msedge.exe	93
PID 2444 wrote to memory of 4284	2444	msedge.exe	92
PID 2444 wrote to memory of 4284	2444	msedge.exe	92
PID 2444 wrote to memory of 4700	2444	msedge.exe	93
PID 2444 wrote to memory of 4700	2444	msedge.exe	93
PID 2444 wrote to memory of 1780	2444	msedge.exe	97
PID 2444 wrote to memory of 1780	2444	msedge.exe	97
PID 2444 wrote to memory of 1780	2444	msedge.exe	97
PID 2444 wrote to memory of 2604	2444	msedge.exe	99
PID 2444 wrote to memory of 2604	2444	msedge.exe	99
PID 2444 wrote to memory of 2480	2444	msedge.exe	98
PID 2444 wrote to memory of 2480	2444	msedge.exe	98
PID 2444 wrote to memory of 4584	2444	msedge.exe	101
PID 2444 wrote to memory of 1132	2444	msedge.exe	121
PID 2444 wrote to memory of 4620	2444	msedge.exe	122
PID 2444 wrote to memory of 4412	2444	msedge.exe	123
PID 2444 wrote to memory of 2252	2444	msedge.exe	126
PID 2444 wrote to memory of 2252	2444	msedge.exe	126
PID 2444 wrote to memory of 2296	2444	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://chdv48hbb.cc.rs6.net/tn.jsp?f=001k2bZIstVz7S8Nuj9iLCVjOAlGm2dei5dpbLeKj7zRJbquKQj1GdC-BB7M4XUIkEaz5E5lqOfrbvG-QL6y256CMOIeFyuRsFFpeXhUGxHb2e7mpCSlqVYJNgfS8hKO8KyPyyq_dvS_LkCuaA1-8QOqTLWxp_AU9_ZYZFkEZmfuTMlsvlRuLYUZrJrmqxJtXpuoJ5S6symUt4uAUypk7Vm76ZXGuPNFrsLp_G-nZMnBtuwq5NddWUdUWIMdJC5UJ6SpGqeZuscmtk=&c=nHZPJPtqLrwsCb4oFkFBo3CpuqDgm4t9ckByeQHHsJ-iWw9MUMaCcQ==&ch=Do1apQpnUXFAnpr9PoR6AXiFMEjoT0-GQ4LJuwQuCGRxy2xU1v3Hng==
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff8e9d2c188,0x7ff8e9d2c194,0x7ff8e9d2c1a0
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,7480096599119112501,10413882088464488077,524288 --field-trial-handle=2328,i,5967140920350428170,8780739170512810012,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1776,i,470736148965640656,15406410011237781041,262144 --field-trial-handle=2328,i,5967140920350428170,8780739170512810012,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,4647823271653955688,9738710737838894600,524288 --field-trial-handle=2328,i,5967140920350428170,8780739170512810012,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,18257626498856893370,2296234947715950079,2097152 --field-trial-handle=2328,i,5967140920350428170,8780739170512810012,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,14881177741012492494,65474557765590081,2097152 --field-trial-handle=2328,i,5967140920350428170,8780739170512810012,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,15924128278589767227,3611283812797973757,2097152 --field-trial-handle=2328,i,5967140920350428170,8780739170512810012,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,17283794761350161188,16357349942623436566,2097152 --field-trial-handle=2328,i,5967140920350428170,8780739170512810012,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4228,i,8726998837274414121,6057152829647855702,2097152 --field-trial-handle=2328,i,5967140920350428170,8780739170512810012,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,8922904108330460979,7273333866307852083,524288 --field-trial-handle=2328,i,5967140920350428170,8780739170512810012,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,3255352835239054041,4710292881419089393,524288 --field-trial-handle=2328,i,5967140920350428170,8780739170512810012,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,2314245400915265119,2587253050343023654,524288 --field-trial-handle=2328,i,5967140920350428170,8780739170512810012,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,2314245400915265119,2587253050343023654,524288 --field-trial-handle=2328,i,5967140920350428170,8780739170512810012,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,13940546548737901194,7630351370926952104,524288 --field-trial-handle=2328,i,5967140920350428170,8780739170512810012,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,3799080573489123537,2825897175876797259,524288 --field-trial-handle=2328,i,5967140920350428170,8780739170512810012,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,3957364041724167955,12194626395896115655,524288 --field-trial-handle=2328,i,5967140920350428170,8780739170512810012,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,6215700551084673097,13109824685250043838,524288 --field-trial-handle=2328,i,5967140920350428170,8780739170512810012,262144 --variations-seed-version --mojo-platform-channel-handle=1044 /prefetch:8
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6100,i,14913364955569249189,17754019735439852099,262144 --field-trial-handle=2328,i,5967140920350428170,8780739170512810012,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2296

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 baafcdc00a8dbd57aaa7473769595115315fdc81c43cb5d3a9cb79138c4102f8
MD5 1e6c7b5d38aef73787c7dd9bf64cf89c
SHA1 c95d5457b628a1420c5cc73302f80e2beb1ea0c7
SHA512 0abe5721c6c74fab4699d1247da5b6271a82cc85e0cd70806a9957342418a332c7bee53a9a498c79ee74f7cd930791edbb99395d61bd729b48fbe45c7a763eb0
TLSH
T14E616E380B6E0482E3A156B1B0E20104707082F5FFDFDE4DEF149DF55A36729C98249B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e73e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e73e.TMP
Size 3KB
SHA256 0b90dfbaa267f3d71d5a860743d8ae4b17c93f15e67d54c84d7ad747e4f1f051
MD5 cb6b35e435e5392890464fb1d492708e
SHA1 29e89f335d4f867e083df309dde38a58fe118519
SHA512 858f9944bc2d44930e5519947b2d0910cdd7fef9cddadba9414bed0266910d0584756de149388761edd0c62a2c08fbc3f7fc136e30844d035cc51f0aa68e069e
TLSH
T17E613B380B5E0482E36156B1F4E20104707082F9FF8FDE4EEF148DF55A3232AC99249B
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 72250189b3c820bc6008d4e73682b5fe65b5a66aa993cea15ebd3259a620e7bc
MD5 622f286e505472db5bd9deed176500f6
SHA1 182aa36544cb7b468ef03f3ba4b032c933fae5b9
SHA512 718ff5043797e99487a11c147a3ab7a8af66a62d81e24756ab8e8dc12c0398a5a6410b40bdbd03055a55f6f139622a6b12852e0a4fb43e1ee465824be9309e0b
TLSH
T1B651BBF2C3E482AECE1155F06A187E17DE2D1928436C395AC9D4FF0B63F2471E60166E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e20de425393f72f970d56c84c01be40ba390d70d281b9ec007472df6051031e8
MD5 2207a6cc98c3e38e2321bf8586e26e92
SHA1 c44fe6c2b8bd5cca855b9aaa92226f9b68571fd8
SHA512 d6338ed725e6d5ac6d840b4e4e9c7b859ba7a3255c401cba6fe39976aa04cfbcbc0cc0ae879598e41e4707b811a1618c01a9ad57cf95e4ac7b22f55162a7ddcb
SSDEEP 192:sxZwRvyM/jK1Ml8Mka/fssFbJEIdpNhHW6+WNifE/Y9Ija+tIgrJ:sxZwZMa/fssFbjfHb9/h9
TLSH
T1FA52F812AA34A977CCDBD209FA45BF53D6F5457292900E54AAFCD91C00E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 643292ffaa34d678c1ad11cfa16e29dcafad9158e9586e3ced2138af2ee4cdcf
MD5 7d7c6b870187bf62542e8a0e4d36dd75
SHA1 912146be40831a35b6691597b9b4a6b4ed16ad6e
SHA512 0b6b5cc08ed6d616b326af08a29f3f79865c09e2055659d36ecf52045cdb9944fcb60de3e99ff67a6333615809728100076ca5f00795cbc1e93ecf5274b31149
SSDEEP 192:sxZwRvyM/jK1Ml8UQ4ka/fssTOJEIdpLhHW6+WNifE/Y9IP5+tIg54J:sxZwZqba/fssTOj9Hb9/o6
TLSH
T1DF521952AA349977CCDBD609FA45BF93D6F5457292900E44AAFCDA1C00E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 666b0d083ad04bb027d0c4f8a4e54f5506eb61cf3a0afa5c1f2b54654dfcd1cd
MD5 0ea1e1bbdaff67b3bb3eb51acaf86130
SHA1 5db0bfbdb3292ad8871fe7335dc59f4ea57d62ca
SHA512 fa0f87b2a906a2cc7bbc7b18940a682dde963dc9c3ab6a72d3d75fda0028aba2ec62096511adbd09e64bad9207aa47a346a60221bf406667acd4b8bceb5a7f22
SSDEEP 768:fIcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNQroMg6U:fIcv21wWvu+Z+u1jaeFLeRN7Mk
TLSH
T102D20B2B280CCB7E4F841E9CED2AAF9A6DD801CB57988D5447FA484C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7559e1c72046a46a8f5489ec09c0b36ef999f619dacd6f89d66c8bb424d792f2
MD5 cb1f1c8f5411eac8bf990ca9f333d762
SHA1 970251fab9278cf12a8d1a0945654a8ecfbd40ff
SHA512 50d36e608534f2792cab046d7dd4de73c27b64819db7087ef21ca0afbd6f18fb0a3dc3330c0eecbe29ed32e82541ffba46cc4f31a073baba4033e08f8683c788
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDWGBuKSAKa+MKbye:mTOxf7
TLSH
T1739164D5307F42813D7EA90C93698D360B433A62341CA5BBBBA840E15EA7E245DFDCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595a4b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595a4b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 85598fe4d451ecea569f46ae18d6407cca4f553072a60ffcd097f143d62c74a1
MD5 d253fb1357b38bb737e5c9c607015fd4
SHA1 e73bc8c39efe7518cfc4f4f073a43133bb9fe662
SHA512 59ca9c4f44b425f9807046b5081c09da2cb643d8ea51546330b64dc2737aade9e6f47252f22a696e4920f491dacae86350b6d0080802e77c7891f5600242af1d
SSDEEP 384:vZcIhsNO+hHEWzzi975e+CBd0eszENXoz5s/IkhrfoRUaBuT:nh+kWPaAJxszE+zmZhrAVBuT
TLSH
T1BE928E715C706C7B5EE2A845F88B31139EF8C167DAD52B90A9ECAB0D01EB5E81316C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cee87863a09cdaa17b607f4ae2810273258567f88487f66109143626a0b429a5
MD5 70681dc9241117d20e7d9f066f479277
SHA1 ac2c9fe80078ed82c6a779f1c7b7d6406c2f3301
SHA512 2ff244f3fe8c023ac0f6df9717a6f1f2437c549988bae882d547597940d0f5a5c691181d6370451676efad8803f3a6c026daa8a25a24335c3255c7b694447d88
SSDEEP 384:UiFiZcIWzsNe8TUNTUlIlMhHEWzzi9g5e+CBd0es2ENXoz5s/IkhrfoRUaBuT:vFQmHwg4kWPpAJxs2E+zmZhrAVBuT
TLSH
T13CD23CF148E3587ADEAD9B43AB7E2D024EBCC163F5856650B7D85A0CCC961BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 253f1acb37ea2651b8b8c0927c4c40bd846e21e43cfc1a4238710e95b8be30a2
MD5 93d9d4da4eea0954d7c84da9e27a8122
SHA1 489df77625e24ea4ee9a2de486e2d9565a4f6e9d
SHA512 11c4a105af713a5f5f7704147eb5704254f9d40fbf7fec407ad592813d2c1ffa08e0b6d8c2c1d1e39b54b9eea2d8a771a687b677da5ad8d6228af386b9b97ae5
SSDEEP 192:JONa6v+YLNQmiUylMZh+CGD+FdeP9ospusI2AU6:JONa6vz/7Zh+CBd0esJBAU6
TLSH
T10C02E835AC382C6B9FF2AE45F4873A175FA82177EA912F85D9E81F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f05a33d5b2fe3eaa89936b7d2df81f9c64fda37ac573ae093255654bdb90b76c
MD5 252311e8f9bbc4a4c2169d443026eec1
SHA1 2d1a76b3409e8c0d3dfc5e8dde692f17abf95ed2
SHA512 22a4a1d8b5556693feb9a74eed9d3a1091a2eccd66c5b797f4eb407c561d5e787881732e77ad327bf032e36ff9ab1fdfda457621ca92325e0b1cb796b8206efa
SSDEEP 192:eONX6v+YLTQmiUyzM7h+CGD+FdeP9osNOeBQCHZq5U6:eONX6vzJ/7h+CBd0esbEU6
TLSH
T1F2121A35A8786C6B5FE2A941F48735135FE59133EA863B91E5EC2F1C01EF6AC2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 3bcc2bcbd3f119827c44254c4b5c81bf7b3d718673d607d99fc520d0f0325b8e
MD5 c16f641af444e129edb117f5bd2ab081
SHA1 ba2b4be07e76494a794678d9962db21fc7a50418
SHA512 eba8e3aa7b7e7757dd38597a2ec5926f5cb52b5f12ae42ccbbea958e854e049316e75139ba7d71888b8584c5c43dc7d133c621328b4dd05758c0f5dfb7fa8d16
SSDEEP 384:eZcIhsNOMhHEWzzi975e+CBd0eszENXoz5s/IkhrfoRUaBuT:chgkWPaAJxszE+zmZhrAVBuT
TLSH
T167928E715C306C6B5EE2E845F88B31139EF8C167DAD92B90A9ECAB0D01EB5D81316D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86206564-82ab-4234-bf50-fc51fd6968c6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\86206564-82ab-4234-bf50-fc51fd6968c6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1858a1664270932fe7efd8ff271daf8ee2f2eb50eaa764e731e38ac84e0e9a5e
MD5 a29f687cd3550cb86a436d57f28edea8
SHA1 09f5000d39183fd7563643543727eea0e43c014b
SHA512 ca0b33241b60a5d280296628342b7b28d1740cf414a586d4a3c59303ce3baf70987260637ef6f7ad83b8d173f577d50ddcfe5ebe08172b819344315949533c2c
TLSH
T18E411C58BAF91158B3B36E5AABF6686D447F7C772E0AD09D10110E4E4622B00C9B2B37
MD5 SHA1 SHA512 TLSH

Submit Download