hxxp://172[.]16[.]0[.]1/

Analysis

max time kernel
148s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://172.16.0.1/
Sample260811-tyf8aahk7x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3328	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309392795584890"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{56D671B7-E48F-4A72-9C14-85B801263A0D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 2540	4740	msedge.exe	86
PID 4740 wrote to memory of 3328	4740	msedge.exe	87
PID 4740 wrote to memory of 3448	4740	msedge.exe	88
PID 4740 wrote to memory of 3448	4740	msedge.exe	88
PID 4740 wrote to memory of 3448	4740	msedge.exe	88
PID 4740 wrote to memory of 3180	4740	msedge.exe	89
PID 4740 wrote to memory of 3180	4740	msedge.exe	89
PID 4740 wrote to memory of 3804	4740	msedge.exe	91
PID 4740 wrote to memory of 3804	4740	msedge.exe	91
PID 4740 wrote to memory of 3804	4740	msedge.exe	91
PID 4740 wrote to memory of 4912	4740	msedge.exe	92
PID 4740 wrote to memory of 4912	4740	msedge.exe	92
PID 4740 wrote to memory of 4912	4740	msedge.exe	92
PID 4740 wrote to memory of 1636	4740	msedge.exe	93
PID 4740 wrote to memory of 1636	4740	msedge.exe	93
PID 4740 wrote to memory of 1636	4740	msedge.exe	93
PID 4740 wrote to memory of 1112	4740	msedge.exe	94
PID 4740 wrote to memory of 1112	4740	msedge.exe	94
PID 4740 wrote to memory of 1112	4740	msedge.exe	94
PID 4740 wrote to memory of 3052	4740	msedge.exe	100
PID 4740 wrote to memory of 3052	4740	msedge.exe	100
PID 4740 wrote to memory of 3456	4740	msedge.exe	101
PID 4740 wrote to memory of 3456	4740	msedge.exe	101
PID 4740 wrote to memory of 4656	4740	msedge.exe	103
PID 4740 wrote to memory of 412	4740	msedge.exe	112
PID 4740 wrote to memory of 412	4740	msedge.exe	112
PID 4740 wrote to memory of 412	4740	msedge.exe	112
PID 4740 wrote to memory of 648	4740	msedge.exe	113
PID 4740 wrote to memory of 648	4740	msedge.exe	113
PID 4740 wrote to memory of 648	4740	msedge.exe	113
PID 4740 wrote to memory of 1556	4740	msedge.exe	115
PID 4740 wrote to memory of 4440	4740	msedge.exe	116
PID 4740 wrote to memory of 4584	4740	msedge.exe	117
PID 4740 wrote to memory of 2120	4740	msedge.exe	119
PID 4740 wrote to memory of 2120	4740	msedge.exe	119
PID 4740 wrote to memory of 2120	4740	msedge.exe	119
PID 4740 wrote to memory of 640	4740	msedge.exe	120
PID 4740 wrote to memory of 640	4740	msedge.exe	120
PID 4740 wrote to memory of 4232	4740	msedge.exe	123
PID 4740 wrote to memory of 4232	4740	msedge.exe	123
PID 4740 wrote to memory of 4232	4740	msedge.exe	123
PID 4740 wrote to memory of 1596	4740	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://172.16.0.1/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7fff4e9ec188,0x7fff4e9ec194,0x7fff4e9ec1a0
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,7614108000133110025,2972126670215544263,524288 --field-trial-handle=2212,i,10247721332784340177,5884091173795505838,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,14085232791475781550,17166155513941438670,262144 --field-trial-handle=2212,i,10247721332784340177,5884091173795505838,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,1326607544916240988,1533526839013332780,524288 --field-trial-handle=2212,i,10247721332784340177,5884091173795505838,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,13691683244097269152,1573214116359438967,2097152 --field-trial-handle=2212,i,10247721332784340177,5884091173795505838,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,15221482380983539717,1090625116319732176,2097152 --field-trial-handle=2212,i,10247721332784340177,5884091173795505838,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,6288652538480283885,3313617178138067132,2097152 --field-trial-handle=2212,i,10247721332784340177,5884091173795505838,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,12749539093331124384,1553118080815824269,2097152 --field-trial-handle=2212,i,10247721332784340177,5884091173795505838,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,2727023064224740664,10624096766959960749,524288 --field-trial-handle=2212,i,10247721332784340177,5884091173795505838,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,14366070808847916459,14385923867226657789,524288 --field-trial-handle=2212,i,10247721332784340177,5884091173795505838,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,11329666525191365693,6267105982838000069,524288 --field-trial-handle=2212,i,10247721332784340177,5884091173795505838,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,11329666525191365693,6267105982838000069,524288 --field-trial-handle=2212,i,10247721332784340177,5884091173795505838,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4372,i,3699960136193260110,11497542203590558660,2097152 --field-trial-handle=2212,i,10247721332784340177,5884091173795505838,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4504,i,1888684990001220834,5607857328947625228,2097152 --field-trial-handle=2212,i,10247721332784340177,5884091173795505838,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,10219690228378606693,2233898788523530140,524288 --field-trial-handle=2212,i,10247721332784340177,5884091173795505838,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,10071668941787616792,10515983364384213437,524288 --field-trial-handle=2212,i,10247721332784340177,5884091173795505838,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,1752467925132550776,4063120813060446143,524288 --field-trial-handle=2212,i,10247721332784340177,5884091173795505838,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4432,i,10128915138163297987,14102235083231446584,2097152 --field-trial-handle=2212,i,10247721332784340177,5884091173795505838,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,14610155489132180734,3073004476705035595,524288 --field-trial-handle=2212,i,10247721332784340177,5884091173795505838,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6588,i,2987556564365348102,2049286430808505367,2097152 --field-trial-handle=2212,i,10247721332784340177,5884091173795505838,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5972,i,3957559756498182958,8593509352237893063,262144 --field-trial-handle=2212,i,10247721332784340177,5884091173795505838,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1596

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 23128f89e539a6d9917edba5433ba399fa473cd5bdf9a718187233ed27680867
MD5 5d25567a354b9018994bd6b66b52b04e
SHA1 c03db79f64feffaee44b27318f739902a7535257
SHA512 03675a014f7f7744db0c63c7bdee43939d9f97a50a59bf48452af727004fb7e3b04344a1ab69cbf3d8cfd17b208612266c2ae37060a624ba13b0d42d3ae2c6d2
TLSH
T1D9711B34C69604E4C7A649FD63C1834039F0C5E9FD872E61A2AC6AF86D567DC83DD538
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 cbf96277d9b11e9cdbfb1b840903c5b672315bca502170345271bf06c52c6fcf
MD5 7958b1a32b4c683c35c6c39bd2142c9f
SHA1 64170a692ea81b29564f68da06cc72e9673f3bfb
SHA512 86d71c87ab45145f476fa745748cc6fefe1b7fb64f9d3a27e25c2ca2bb7c7ecb21509eab94389fbe238ac74b120c5ee56363430338cc4a66fed57f704b67347f
TLSH
T1DA119BF3C3E585AE8A1116F09A24AE2BCE2C060542183C5589D4EF2B93F3465E00255B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 24b62481bb1c94653dffb0e636a6a80f34b3278711895bda35cdaba0c6992bbe
MD5 8049fe0ccb0762bba11fd6d40524cb7a
SHA1 fd7f6c364a47ae5555ad286d1310d0a62c4e9ab5
SHA512 aae38eaf3c966b73679494468dc6e2204b4c6728c7a558d553f2dc201f5a8687470da580d786e196021973dc95a97d5b2dcb82b27b2488e9b9f801a64565dd8a
SSDEEP 192:sxZeRQk//fvsZly+IdpJHW6+WNGYzcm8lIg54J:sxZel//fvsZlyJHbGve
TLSH
T1D222B8126E28A57B8CC7D20DBB19BF53E6F9503291D41E58E6FC961C05E6BDD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 320272c3008b44fece20b5ef5bf4ee59e9ec3461892473b5bbb18bc55c05adef
MD5 e0a5b5bd5eaae9a4356d55fd08978f71
SHA1 2245b93b62e6c2b63c9dcf3970d85888b584601b
SHA512 2885939e93dc8a6a7aa108d7453de6c545849b27e5252909b97d12cc0e25d363cf9253c6af491b87306488593e9c92b7c714ff9b29067acfead0b7dbfa2d69ab
SSDEEP 192:sxZeRQk//fvsZLR+IdpGFHW6+WNGYz9rC8lIg5aJ:sxZel//fvsZLtaHbG8pM
TLSH
T11122D8526E28687B8CC7D209BA19BF53E6F9503291D50E58E6FC961C05E7BCD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 85c1cb025718c23aa3674d3d5c45c92de32cf65fa0f772fdc574c9f55ffc9ba3
MD5 6b5d94d0da2a7a35a5ec9b5cdb15071a
SHA1 e708468fca2d2c55d97ec84d6460e9ddcf6fe572
SHA512 1a324af40d1cba595e1a0569132aafa44bd8eab358fc2cab750d26b4089530f1644885d1e565a717e4165cd3b53cbfd302e4d46494d042ced16c8bd0116be2b7
SSDEEP 192:sxZeRQk//fvshly+IdpJHW6+WNGYzcm8lIgrJ:sxZel//fvshlyJHbGv9
TLSH
T1EE22B8126E28A57B8CC7D20DBA19BF53E6F95032A1D41E58E6FC961C05E7BDD120B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 d8c3325e8b3ed5a930fb0c9988dd80d31f956361dab3fdce4935f5e2086ca8b7
MD5 ce59149e733b8689101d083bfca4b6d4
SHA1 5c08b946150760276674cf964a30157cca5b18aa
SHA512 79a8ad36f6e2146896fcd9942d85b0229130f3eafaaaa062cf62bf80d08d576af690c94f0ec184cf53d0fdfe3ef580e2576269e9d2806a3bc345e82b12ed287b
SSDEEP 768:Lnk7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSB4royGrkYH:Lnk7u70WvqiEau1jai5LA3BD5rBH
TLSH
T115C2E93B740CCB7E4F801E9DED566F973E9802C7A6948D4087FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 436fde5e729ee650edca97c27b0ed976d90147825acf73216c10b38d6bb85a29
MD5 6c97db428d4b94915a4e397ec8577369
SHA1 d1bd8baeeea771a475ce6c9f572e988e3a3654a9
SHA512 fd004e635c07e43cc8e2fdfbc724227243e9968ce59ec611a09260350b9190f8325e63bec2753d61eeea26c0dc08b0e1ca415d42a558980691b58cc8d0a6a771
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTfrIRKsY8HydfIFKEcAg+IXKrV:KIbCKcfruKsY+WfmKEcX+oKrV
TLSH
T12A912685753B4A527CBF29489396863B9E4231633418E8AF7FB910A21E67E110DFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59ad9b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59ad9b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 331f95cd06ac8eb3859eed1f564cf45c6047611b21866d6482674ea892ea9c80
MD5 ebb2a085690f11e06254c667290a69ca
SHA1 ce46e4467c92d42b5438c94bba201e1fd8516a89
SHA512 3e3b3e04c7e86f2822b9d94379d9cfc3e3d585b033072e7c86035a3065e8af180cc01e7eca26f0fc2379ffe557dd62a2de2c65e062a18ac80c89106df844d67e
SSDEEP 384:iBZcIhsNgDqAEqbZAQtdMbDHOOPrXLpe8C/xtnh3v:iJheNqyQkDHOi9PUtxv
TLSH
T1E4928D319C786D676EF6E641F48637075EF89137F6C42B98A6EDE70C06DA2A80307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 02826cc50d7dd125f3a3db7cec075f71b5248ea0a803d98b3be2485008fd30a7
MD5 2c4d72f719ff1a6949d5385185375d5f
SHA1 de65a56c3d1535481eded2c2db0b30b8a14b9c12
SHA512 c49ab7120b762a00dc26bfa5a47e52f5fe7f4ecf592f8f09af9c3453c840cdf13c7459a3b095ac19279ab55ee2b7ff9522599fd2907410d505b865edddea15d5
SSDEEP 384:1BZcIhsNgeqAEqbZAQtdMbDHOOPrXLpe8C/xtnh3v:1JhPNqyQkDHOi9PUtxv
TLSH
T1CF929D315C786C676EE6E641F48637075EF89037F6C42B98A6EDEB0D06DA2A80307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a7a5f0bc21dc66b2ebd4a81a99f23b4cbd071c87cca2bce13a599bef09d411ca
MD5 18f05cd8e6528b65959b9c47ca7fc291
SHA1 cd30cf6c7eaeab112b4a5dc50478819912dfe33f
SHA512 a490299857d251ffff0174ed8559547576d449389ea02678410c1883c0c2b6718420f2a4e835d035876cc7b30b09d4a93e481970bf8de75dc3e4476d66756907
SSDEEP 192:gONJ64BLQmiUyduQ5GBPKm2+FdGr5VkE4WwDqIU6:gONJ6e9pQidMbeHU6
TLSH
T100121A356C786C3B5EA27541F08736076EA4523BEA846F84E6ED6B1C01EF7AC2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 83b38e2def18031e28306bf88885efe600043abd186db91e8d3ff350670698c1
MD5 2a9924b2e38325c549d7fb93d918e515
SHA1 6d65036d66bc242bfd0d86b2a434818b3dd69135
SHA512 10422fd038e345e1240ef9a3d385b7950f323c1e7fbe97266964d084f6c95af631b6d37a86ba1cabfd9e65124513e55b25e590c050465c3d6a8b7988de510590
SSDEEP 192:MONG64BAQmiUyT1uW5GBPKm2+FdGr55aDKZU6:MONG6eAEkWidMcGU6
TLSH
T1A5020A396C782C7B9EB2AE45F48737175FE8113BE6915B44EAE85B0C00D725C2303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 339f83bed890e87d7900b1d60147d58d756cdaa4298909b4b0549680b7741154
MD5 9169f675ab16ca3312395306f1f8865c
SHA1 a3337f04a720afa1de618dc924d267f1a9ba369a
SHA512 390b3a039973df4f1653beb6ebf8aaa6164ea633a10461031bcc45316c4ee381e3c5714951107f03f55f625851b71412506a206e00136fe28bd89f83e35d4542
SSDEEP 384:tAiFiZcIHzsNg8TUNTUlIleqAEqbZAQtdMbiHOOPrXLpe8C/xtnh3v:tbFQTpwgpNqyQkiHOi9PUtxv
TLSH
T13BA28D724CA8997BAEB6AB41F58633079EF44077EAC4A694A7DDEB0C01D72E80307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d96479b3-e41b-4b62-b5b2-16d859457321.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d96479b3-e41b-4b62-b5b2-16d859457321.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 423e9735f4686a0955cc9811b0a43cf89450da4080a44d421f633b964fbb1f50
MD5 4a95e4c7d64e834f0c3a260482594215
SHA1 ba0f87a953e985d2a56644f591b3d54fccc5b8b9
SHA512 cb5e4e18807bcd1a9f6a9b8bd37c26bca5f6cc2e4edd334fa09d0ed9784619a27560abf77c36b61c592a635bd34b404f31fc8f728162a55291f32a51297e0710
TLSH
T1AC412798B6F91148B3B76F5A9FF6A46D487FBD332E06845D50110E4F0A26E40C962B37
MD5 SHA1 SHA512 TLSH

Submit Download