hxxp://www[.]cis[.]edu[.]sg/

Analysis

user interaction
yes
max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 03:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.cis.edu.sg/
Sample260814-dwecxaeh67

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2840	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311512877516774"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{AB4DDA9E-E4DD-4ACE-AC8F-3327818A8276}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3332	msedge.exe
3332	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 456	4600	msedge.exe	87
PID 4600 wrote to memory of 2840	4600	msedge.exe	89
PID 4600 wrote to memory of 1684	4600	msedge.exe	90
PID 4600 wrote to memory of 1684	4600	msedge.exe	90
PID 4600 wrote to memory of 1684	4600	msedge.exe	90
PID 4600 wrote to memory of 3900	4600	msedge.exe	91
PID 4600 wrote to memory of 3900	4600	msedge.exe	91
PID 4600 wrote to memory of 4916	4600	msedge.exe	92
PID 4600 wrote to memory of 3808	4600	msedge.exe	93
PID 4600 wrote to memory of 4916	4600	msedge.exe	92
PID 4600 wrote to memory of 4916	4600	msedge.exe	92
PID 4600 wrote to memory of 3808	4600	msedge.exe	93
PID 4600 wrote to memory of 3808	4600	msedge.exe	93
PID 4600 wrote to memory of 2808	4600	msedge.exe	94
PID 4600 wrote to memory of 2808	4600	msedge.exe	94
PID 4600 wrote to memory of 2808	4600	msedge.exe	94
PID 4600 wrote to memory of 872	4600	msedge.exe	95
PID 4600 wrote to memory of 872	4600	msedge.exe	95
PID 4600 wrote to memory of 872	4600	msedge.exe	95
PID 4600 wrote to memory of 2524	4600	msedge.exe	97
PID 4600 wrote to memory of 2524	4600	msedge.exe	97
PID 4600 wrote to memory of 2524	4600	msedge.exe	97
PID 4600 wrote to memory of 3132	4600	msedge.exe	99
PID 4600 wrote to memory of 3220	4600	msedge.exe	100
PID 4600 wrote to memory of 3132	4600	msedge.exe	99
PID 4600 wrote to memory of 3220	4600	msedge.exe	100
PID 4600 wrote to memory of 4012	4600	msedge.exe	102
PID 4600 wrote to memory of 4008	4600	msedge.exe	106
PID 4600 wrote to memory of 4008	4600	msedge.exe	106
PID 4600 wrote to memory of 4008	4600	msedge.exe	106
PID 4600 wrote to memory of 4052	4600	msedge.exe	107
PID 4600 wrote to memory of 4052	4600	msedge.exe	107
PID 4600 wrote to memory of 4052	4600	msedge.exe	107
PID 4600 wrote to memory of 3668	4600	msedge.exe	108
PID 4600 wrote to memory of 3668	4600	msedge.exe	108
PID 4600 wrote to memory of 3884	4600	msedge.exe	111
PID 4600 wrote to memory of 5048	4600	msedge.exe	112
PID 4600 wrote to memory of 208	4600	msedge.exe	113
PID 4600 wrote to memory of 3024	4600	msedge.exe	118
PID 4600 wrote to memory of 3024	4600	msedge.exe	118
PID 4600 wrote to memory of 3332	4600	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.cis.edu.sg/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffe4559c188,0x7ffe4559c194,0x7ffe4559c1a0
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,5668782548367879406,14670145935958844951,524288 --field-trial-handle=2312,i,6428367990871819601,1931069691117071074,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,4047585315300092988,3320675024870536285,262144 --field-trial-handle=2312,i,6428367990871819601,1931069691117071074,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2364,i,5623970883349521355,5634652018190437224,524288 --field-trial-handle=2312,i,6428367990871819601,1931069691117071074,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,7325352525048618011,15242197229359911159,2097152 --field-trial-handle=2312,i,6428367990871819601,1931069691117071074,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,17544210531133810401,9230371649086904290,2097152 --field-trial-handle=2312,i,6428367990871819601,1931069691117071074,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,14756046507351889077,7426059053955728670,2097152 --field-trial-handle=2312,i,6428367990871819601,1931069691117071074,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,14436001838158790528,3231597346432826920,2097152 --field-trial-handle=2312,i,6428367990871819601,1931069691117071074,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3644,i,12386341144726848932,13765059077657401513,2097152 --field-trial-handle=2312,i,6428367990871819601,1931069691117071074,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,13277316491084246757,17388046286794402309,524288 --field-trial-handle=2312,i,6428367990871819601,1931069691117071074,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,13507162338506233468,1008016594927605412,524288 --field-trial-handle=2312,i,6428367990871819601,1931069691117071074,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,7453049565989024892,3672651446256969122,524288 --field-trial-handle=2312,i,6428367990871819601,1931069691117071074,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,7453049565989024892,3672651446256969122,524288 --field-trial-handle=2312,i,6428367990871819601,1931069691117071074,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3556,i,17024885618509931955,9896697814395317319,2097152 --field-trial-handle=2312,i,6428367990871819601,1931069691117071074,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3688,i,2126884646869707322,16454290990630186097,2097152 --field-trial-handle=2312,i,6428367990871819601,1931069691117071074,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,15863935105794823758,5590085764318224166,524288 --field-trial-handle=2312,i,6428367990871819601,1931069691117071074,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,11081347892920327122,11702417153095534880,524288 --field-trial-handle=2312,i,6428367990871819601,1931069691117071074,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,7507991469006769359,6771712624069767033,524288 --field-trial-handle=2312,i,6428367990871819601,1931069691117071074,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,9473862603156317498,15808697619757508412,524288 --field-trial-handle=2312,i,6428367990871819601,1931069691117071074,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,790139129074057096,2334830977635806602,524288 --field-trial-handle=2312,i,6428367990871819601,1931069691117071074,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6308,i,11902804945562081157,9750122315180459906,262144 --field-trial-handle=2312,i,6428367990871819601,1931069691117071074,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3332

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 337373c4da28ee3002914faa7f66bd64bd0d39f2478ab28111896aef3d732e8e
MD5 1538b94629725dbea32dff25f55639b2
SHA1 133e292c7d10ee2edc74eda507e40b826be644bf
SHA512 ace9ab652f654068c864bb79cea4a34770b9e3e2dfeab9c984cbcd6625ccf3ed273271281737948f7076a7204abb9af1697268a6d42c8b81e2eed910356306c4
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1DFB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 a1442fe53cfe7c74242ad9bd215780ce577682f10a14e0e70f881544ef9a306e
MD5 8403ce2e37a9c475193528125c27f20c
SHA1 adc312a94ce1dacac03bb27cd8361325510bc0bd
SHA512 eb631a3c6ea7bd910605c1a00cb46ac778c6b841bca0130056a453c0a41f12c8fe9d077269e3ee418af57b94d42fd39f29475d0a215a248cfe8db5d0592e26b6
SSDEEP 96:40ecXs65xst4ySuqnXQKDQ7+Ojag2plLoQ6jIuDRsS1HYe+swqqBiqdtyiegDqVg:4yQxjZqaj+eVhewO
TLSH
T14EB1B5366AD89DDAF72402706CD2B668B0B1C5D9F8879FA6F754CC720A0A7018BD9C64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5944a0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5944a0.TMP
Size 3KB
SHA256 fdaa0252b0b7d1b66db64a8ede44e954549982d8bdf0172c675609cfbd892cb8
MD5 ee1133331bb9f49b482db3278ffa3d21
SHA1 aeddf3805cbfaa31a17c2cc4838fbb5d4605f169
SHA512 f8d3f61a73618ba5b6a42f1be1710c3a41d412a8926dec8a681862075b270e0600505d72bdb3d1afa917ece2998873ae18f8badda9a9116ee2e24fe82627871b
TLSH
T18B713B3B36C89EE8D35103B13DD2C208F1A182D9FC979BAA7294C4B31915B12835EDA4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 717f6e5333bd09c7e8f94d928701562f971318e0ca1b54aeafa95150302f7e3d
MD5 22e793322f63ac4a4f94b96f35de0c86
SHA1 e262dcd71cdf9555c52c0c60979066f319e9bc4a
SHA512 67db9bc3cc431b2b3c9d1704e4e6b221872cd047426d548aa5a3c3bf849eff7c2c171ec7057046662b02fdd379012905c56f60ae9d1a8037df7b308844471b9d
SSDEEP 192:DHu+eusunubu0uWu8uSuXureu0uAeuZ9uPucTQuv1u1uRgufuDuNuxufVAu6uAJ0:DHu+eusunubu0uWu8uSuXureu0uAeuX2
TLSH
T198329ABA8BF4863D9B1191F09A15AE1BCF191515435C3C7AC9E8EF46D3E20B1E10276F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1e9a2144c2dba611b000c9bdc9ee419b14febb8fbe0416e86a6dfa7b58281bdb
MD5 6825bc3fe355008f6ccdc55d4a1b785e
SHA1 89b71252483040db8e20c08625dd68427add158d
SHA512 7be925333662f30d55d9604d3f4546b5ecf5d534b9f3756a3992d442b6bf002b391b874adb7054c5534af977e7126b6bc08dfc71d0bc56209334f93902e55a6c
SSDEEP 192:sxZXR6yM/jK1Ml8Mks/f2stH0kIdpWWHW6+WNehm/YCtLawCIgrJ:sxZXwMs/f2stU9BHb5/YD9
TLSH
T1FC52E8116A34A97BCCCBE209B951BF53D6F91572D2900D44AEFC9A1C04E7AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2611b272025a4a51786997744900d68688c39d6a767d733b0f417be19ad96235
MD5 f409207d8b83e6d5a94fb873eadad265
SHA1 11a49aa040d69422891d6e79bd17403c29c71848
SHA512 d9a49cd3833a5c73a1f8f61de7d83e49c912070ed2579add53242c4066ac6016e374c3dda5240a4fe7d95cddb0aa0bf01e74ed5c8f4350265ed307f6b9bca6db
SSDEEP 192:sxZXR6yM/jK1Ml8UQvks/f2sMHpkIdpIWHW6+WNehm/YCDwUwCIg5SJ:sxZXAqcs/f2sMJ9DHb5/PDo
TLSH
T1F752D6556A349977CCDBE209B951BF53D6F90472E2900E44AEFC9A1C00E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 40353675e9bd91f9ae40970e91ed17983356a6b99e9949decf17754b3e384535
MD5 041362e001c02f726e05f57c908feceb
SHA1 dd76c3ed6bdc26fae4dbb1f003dd24a351c126f7
SHA512 20f3a01a335463d2ba763b52b9c339c16e5993625380ed5d3f884b3fea5fc9d995c7f615f1dce2d5fe589ad806af3666dd6ac828af794fa05af8356e4a618ecd
SSDEEP 192:sxZXR6yM/jK1Ml8Mks/f2sMHpkIdpWWHW6+WNehm/YCfnawCIg5SJ:sxZXAMs/f2sMJ9BHb5/ODo
TLSH
T1AD52E7516A349977CCDBE209BA51BF53D6F90572D2910E44AEFC9A1C00E7AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ba64b4b4693edc42ca22ae4be3c8a9ad025dfed6dde9525f6b0bbc2f41cbdd5f
MD5 348e35d8eb8b6f87c441441e91974382
SHA1 95ac46cb8076482e9abef4bacf2dd85b1fecc3ec
SHA512 3b9555e93cdae511c3b5b1d7e0f3cb5ace341abb6621302b20f591a16821bec01c13c106322aa28801479ef92dfdbb3ad5b025a3c27ddd167b7453aced628b53
SSDEEP 768:zs8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVEroW:zs8bqn+WvSCt6u1jaCZLbWVPW
TLSH
T14ED20B3B280CCB7E4F845E5DDC266F962ED801CB67988D4447FA884C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 bc165a6d70d00d0f4b19debdb107afcc3ad712423b4be0649e2e24766191198c
MD5 61134f4e75db5b47d804fee511f7da33
SHA1 eef4563192bca2357c1a9a0448076a3fe5cc1df3
SHA512 9346d37794a6128459088a41dddb8c7c4ac9b7fdfbe15a61ef3275a036d23e832fec1a9510f5d09b8dab94e0cf8b2e2afea5886f44c092444d60a1d037a868e6
SSDEEP 48:K8UI7KNyc/yFHIRKc4sUjIVKIUo3yZWInKnqg0:K8UgKNyWOHaKc4TjOKIUSqWkKnq/
TLSH
T18CC1F82332B7024128BE250C93E9A6779E52B1737814E56F7FB850E60E66E216CFD4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1bc94f53-0b09-4fc7-9942-8d0719fb9fee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1bc94f53-0b09-4fc7-9942-8d0719fb9fee.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e84da5df875940b67cf141a0198e22617c4bba34ea7df7a0e4e0df3b7f413668
MD5 c3db4b073f5fb8a3c4c3971371ca66af
SHA1 4c86d449b45055046e1259a0df7f4f29502908cc
SHA512 7669e6ec32fe6035619d30f1ec980cbc519ed6e81a9daf4ff77f8dadd1be0d6c71b0584b5a6d8caea8e40f2aa6c9ad8d763ce7e537d219cbcd98ccfbbfc41745
SSDEEP 384:gZcIhsNGPfKiayEa+zOhzlh+OOPrXLpe8C/lBp:eh5u5a+Ofh+Oi9Pup
TLSH
T1E6929E71697C9C636DE3AA85F88637079FF840A7E6C52B94D6DCAF0C01DA56C130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a638b06ab62a0350d3d9c0038cc8822d12d04361480a0fe139152aad957e9934
MD5 7273e5ff7703a2505fcdf75f2ebb687c
SHA1 0c06ebe12c14267ed214abe584e9dafde9782f84
SHA512 a5f90c58cb0910505e73267f8f39e225e8c1b2834505f1d3d3d2fc1e25c08bd29696e81303f4f96ba10dca832dc96eca0e24f6c9bcdadea46e9a23e9976adb9b
SSDEEP 192:vONp6Db6QmiUyRJHBa+jXOm+tmUJARgd8mxU6:vONp6uCHBa+zOhzJjxU6
TLSH
T1AA02FA3569786CB79EB26E49F8873B179F94207BD9562F84DAD81F0C00D764C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7168f60ae52b7bfbcec9232989687303a0a0e5b952a8714ab36944e110abde1d
MD5 d6ce13812be007e83f4198f945a56fc4
SHA1 6345de5cd1c5196f001c40022816d9368041b4f5
SHA512 430e271fe32558bba348e869a5d5251bd978feb51f94acc597f8a5407bdf1a785b1a15259777c23a2ea6574433a8438249d9615700e6999b8d1384cae445cf90
SSDEEP 384:biFiZcIBsNG8TUNTUlIlPfKibOyEa+zOhzl0+OOPrXLpe8C/lBp:2FQBXwgxG5a+Of0+Oi9Pup
TLSH
T10FD22AF258EB8876EDAE5B47A77D2E038EBCC063F5856554B3885A0CCC9617FC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 82d3cfd1339345f27bd0b81fa3f420bdde4e17d1cfb8854ec535733866c433c1
MD5 1158b77e9cb94fe3fa3e07d4d060a9e9
SHA1 5ecbecbced575075a2db6d8c6e5f09a61abd51d6
SHA512 166e44b4a2f73227a38410568ce1d532cb643f4e14ac86dca3346602e3860c2bbccc48f925f75df3afbd546bfb7eeff5cc1e18afdc24e451cfe76341f6af1060
SSDEEP 192:uedLsNG1Qg3j3bi5kQmiU1kdd4Ea+jXOm+tmUJ/Hamvq59YyXj/lMZ:/sNG1fKiayEa+zOhzlh+55A
TLSH
T1DD42297268789C775DE26649F4473A139FF840A7DA8A2F94D6DD5F0C01DB29C230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 923126460a1e682b5222ac5af71f2aa0b669004471d1db8b6e55c4589d423999
MD5 69966add1371caee1168a935c49046d3
SHA1 0d016e37099c39a67ce26f080dc8b8fb355d4e46
SHA512 a568bd1ecf8d7a097fa69c0d83180af4892ef934a197f610144c0f7b421721c373c5bfcc731556fe2adccc801894e1fe1eea0aec55c7619a857812417aaa4f9f
SSDEEP 192:7ONP6Db8QmiUyRJuBa+jXOm+tmUJ/9Nzvq5U6:7ONP6E4uBa+zOhzlT+U6
TLSH
T1FC122936797C9C775DE2A584F48736179FE84167DA8A7B90D6DC2F0C00EB69C230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c74913d8199764ac67b1363e9008e886b1c7f63bf4908a0de3d851421a754098
MD5 59ad2f697696fce493b9286eceac6986
SHA1 3106e002f5b106ae1ba7324373fb593369b0b0d5
SHA512 8884aa7d80269f19d1a11f41c0081c131e8ec9d8e850021f0de97f29cee1a6225b3b4293358e7cd3f7941276e45119184bd6c85ef941f29a667d0f345890e6da
TLSH
T17D412758B6FA1148B3B36E5A9FF6A86E487B79372E06C45D10110E4F4A63B40C8B1B33
MD5 SHA1 SHA512 TLSH

Submit Download