hxxps://quickbux[.]org

Analysis

user interaction
yes
max time kernel
118s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 01:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://quickbux.org
Sample260815-b3mxhsxtcv

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4008	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312316281472416"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{F6E9FB04-E816-431A-B88F-11401E7BDB26}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 3516	1168	msedge.exe	86
PID 1168 wrote to memory of 4008	1168	msedge.exe	87
PID 1168 wrote to memory of 4688	1168	msedge.exe	88
PID 1168 wrote to memory of 4168	1168	msedge.exe	89
PID 1168 wrote to memory of 4688	1168	msedge.exe	88
PID 1168 wrote to memory of 4168	1168	msedge.exe	89
PID 1168 wrote to memory of 4168	1168	msedge.exe	89
PID 1168 wrote to memory of 4468	1168	msedge.exe	91
PID 1168 wrote to memory of 2940	1168	msedge.exe	92
PID 1168 wrote to memory of 2940	1168	msedge.exe	92
PID 1168 wrote to memory of 2940	1168	msedge.exe	92
PID 1168 wrote to memory of 4468	1168	msedge.exe	91
PID 1168 wrote to memory of 4468	1168	msedge.exe	91
PID 1168 wrote to memory of 2884	1168	msedge.exe	93
PID 1168 wrote to memory of 3940	1168	msedge.exe	94
PID 1168 wrote to memory of 2884	1168	msedge.exe	93
PID 1168 wrote to memory of 2884	1168	msedge.exe	93
PID 1168 wrote to memory of 3940	1168	msedge.exe	94
PID 1168 wrote to memory of 3940	1168	msedge.exe	94
PID 1168 wrote to memory of 1452	1168	msedge.exe	98
PID 1168 wrote to memory of 1452	1168	msedge.exe	98
PID 1168 wrote to memory of 2128	1168	msedge.exe	99
PID 1168 wrote to memory of 2128	1168	msedge.exe	99
PID 1168 wrote to memory of 3936	1168	msedge.exe	101
PID 1168 wrote to memory of 3620	1168	msedge.exe	112
PID 1168 wrote to memory of 2620	1168	msedge.exe	113
PID 1168 wrote to memory of 1356	1168	msedge.exe	114
PID 1168 wrote to memory of 4832	1168	msedge.exe	115
PID 1168 wrote to memory of 4832	1168	msedge.exe	115
PID 1168 wrote to memory of 4832	1168	msedge.exe	115
PID 1168 wrote to memory of 3924	1168	msedge.exe	117
PID 1168 wrote to memory of 3924	1168	msedge.exe	117
PID 1168 wrote to memory of 216	1168	msedge.exe	118
PID 1168 wrote to memory of 216	1168	msedge.exe	118
PID 1168 wrote to memory of 216	1168	msedge.exe	118
PID 1168 wrote to memory of 4952	1168	msedge.exe	119
PID 1168 wrote to memory of 4952	1168	msedge.exe	119
PID 1168 wrote to memory of 4952	1168	msedge.exe	119
PID 1168 wrote to memory of 1688	1168	msedge.exe	120
PID 1168 wrote to memory of 1688	1168	msedge.exe	120
PID 1168 wrote to memory of 1688	1168	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://quickbux.org
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x25c,0x7ffdc902c188,0x7ffdc902c194,0x7ffdc902c1a0
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,12443537302836271156,7270307264089675085,524288 --field-trial-handle=2848,i,15578914661209916550,13347844845520269699,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1712,i,17133778851633014721,12658099859855695110,524288 --field-trial-handle=2848,i,15578914661209916550,13347844845520269699,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,8430760957403151792,8459479594398021938,262144 --field-trial-handle=2848,i,15578914661209916550,13347844845520269699,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:2
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,6888816566645952805,8028742066011070260,2097152 --field-trial-handle=2848,i,15578914661209916550,13347844845520269699,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,1423265791179573047,10000212768250245210,2097152 --field-trial-handle=2848,i,15578914661209916550,13347844845520269699,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,3143269948127110464,13947994593450846627,2097152 --field-trial-handle=2848,i,15578914661209916550,13347844845520269699,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,12464254557597153207,17654743076542171846,2097152 --field-trial-handle=2848,i,15578914661209916550,13347844845520269699,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:2
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,12548412890065760816,11648806979305647584,524288 --field-trial-handle=2848,i,15578914661209916550,13347844845520269699,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,10716433146808758627,16629304547429332885,524288 --field-trial-handle=2848,i,15578914661209916550,13347844845520269699,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,4327593839411553698,8578251506779831889,524288 --field-trial-handle=2848,i,15578914661209916550,13347844845520269699,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,4327593839411553698,8578251506779831889,524288 --field-trial-handle=2848,i,15578914661209916550,13347844845520269699,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,350406308419625946,14647729155561822324,524288 --field-trial-handle=2848,i,15578914661209916550,13347844845520269699,262144 --variations-seed-version --mojo-platform-channel-handle=140 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,5880222841979456383,16637657082569078250,524288 --field-trial-handle=2848,i,15578914661209916550,13347844845520269699,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,9422600667774020206,8417472744287537670,524288 --field-trial-handle=2848,i,15578914661209916550,13347844845520269699,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5188,i,5716161346049809586,15736550405544504864,2097152 --field-trial-handle=2848,i,15578914661209916550,13347844845520269699,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,10319462552695257594,662638121267118521,524288 --field-trial-handle=2848,i,15578914661209916550,13347844845520269699,262144 --variations-seed-version --mojo-platform-channel-handle=1240 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4864,i,3164173823780376961,2405145295584067774,2097152 --field-trial-handle=2848,i,15578914661209916550,13347844845520269699,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3664,i,11646857198997215307,14494278897182459501,2097152 --field-trial-handle=2848,i,15578914661209916550,13347844845520269699,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4180,i,14033032842142215219,16395564002618182051,2097152 --field-trial-handle=2848,i,15578914661209916550,13347844845520269699,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:1688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 965e5ede1dd95e7182bc6ed8b645e4796c53616af10fe7a02b411984e0f5fca1
MD5 252c38f22d645a5fc39fa9f1fdd92b34
SHA1 70c6079cc3ffdcb0efb6f56834b64311e1e951bc
SHA512 e23e1b164567d933593229d39744ddacb3330f715193f293c7aee9a5a95fc433809933ab830a7a1c5cdf37824965c32650c227083092c2a6488a2ab768744ad1
TLSH
T110D09B7077CDAC11D9450471D45547535D96CA4C24D7DB076011801D58567D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

9a198705-77db-495b-bca6-1c2fa810363d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9a198705-77db-495b-bca6-1c2fa810363d.tmp
Size 27KB
SHA256 07647695c33a8bc30bf941fc6026208e5097bba819a98cbff8742365dcd5e5ef
MD5 fa5e71c58d8ecd365d2e39e765ed444e
SHA1 c1f5c4f18b320f69c7b31c7fa6c29637cfc9c06b
SHA512 93a31d87fc2896fafd120078c895aca6d1c14d182b897de97165acf341e65567ae13e4c390f30403c54d37c23e4a21cb1c76e30d63c7bc0ddbf02da989660c42
SSDEEP 768:IUmjYDmWvmKyE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBPLlrZ+DnrofZiaV:IUmjYDmWvmKyEu1jakPLZQD0Rz
TLSH
T1FDC2F93B244CCF7E4FC01A9DDD5A6F973EA802C76A588D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 63471dfb216181c1b6067085c25f549eed03ed738635072f24041aee7558e4e8
MD5 e376cd38f0338a9de93181ce9c354515
SHA1 f74abfe1b70229208971b42b0c9eb2d60e341bfa
SHA512 b2a78603b66632b289e5863e5f5fa4736a3da1cc844bdb62850e59feeb2076349e9bbfebaf780fc65a73a136d813ac63ac7ffc3fb914e164bb0a06e90e586536
TLSH
T1A5517F6E03452892E330A630D4E913517472ABFE08274E5D83E09E7FA62F7E5895799C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ad051804332ffa3bc304326bc738363173e2b7733f4b9bc4ecdb94b44a6adda3
MD5 0fde88797c4f882c82e2f0a3d01eda8e
SHA1 8f1b6dece7b1b29eeb8f67fb6131feb771df0145
SHA512 0d6ca73649b82994806f35fb7bfe69b374915c73347baf343782a40bd5dfa4b24273a9365ac98c8e9fe39d9b2b951efe00223efe8efecad3a1792cf01d2d7396
TLSH
T1D251716D03456883E330B630D4E913117432ABFE09274E5983E0AE3FE62F7E5894749C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c917.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c917.TMP
Size 2KB
SHA256 13408651bf6c1a7dc8f0c237380c874e7f9c549a51f964536c72aede22826001
MD5 d056f59a5fa4bbe28ecf02ccfcfd397a
SHA1 f924ae4f33a144e1df0ba096aaa7b8954f233eba
SHA512 4acdd313fb2f2de30f33b606a1b88080134e018c1779d53152958428e7eb6cc1350826ec26b57d09ecc6cbb17d7256660a804853bad79f2536ae263a2a48a94c
TLSH
T19551816E03456883E331B630C8E91315B432ABFE08174E5983E09E3FE62F7E5894789C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 594d024c60b038ff9ee74dd012f9268db35f6897c98086407d740a0bed08dee6
MD5 b74e916886d49b9fcbcea5529879d995
SHA1 aaf8b388024268e8a98244e0938bea396d6de1a0
SHA512 0c5368b03950b32642eb03fc8db732ddd0b9a2eb6e8a0e1bf7aec06ddbb275c685f1c924e0b878559e6a5b924a7556d79f725513170186a93e453ad18d237e3f
TLSH
T164419DB2D2E9962D8C1562F09B18AE27CE5C091542183D1ECAD6FF5B97E3470E20254F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5bac068062c69f0c9ab2078c02c56db6bc9cb9e432be46e12e03ce01742377af
MD5 2a56b374a4d631560d0d41c60a782472
SHA1 e4ff42c21195fccbb53348732b0e30354657e907
SHA512 121b422aef8a6268d7c1644a14914ee3392393c6cb193ea1b8fe17b28069f938f25cd6370b52e7093907e432c5fd83bbd6e90593730a82be1013b8e978ce31a1
SSDEEP 192:sxZZRqkz/fasHOqIdpRnFHW6+WNGSB/YwqvCHIgrJ:sxZZLz/fasHOjfHbt/N9
TLSH
T1A822DA126F78A97B4CCBE219BB15BF53D6F9503261941E48EAFC861C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 116e68fe1013e4f106551813d2d9a35878ed716ab2e2a7da510e0a511bdf50eb
MD5 8fdfa48e484f43ed61202a0bfd75b1ab
SHA1 6d0b19b9d26e7a530fcf7c0e3c9b47bc03a84bb6
SHA512 81bd7338b01a04157aaf5d930bc07f41aa5f368cb5abb0d8f1836e412b21454ca503f6f157f4c41f460b7457d41b1e6b4cc94592ac60a1c37414976789764bf9
SSDEEP 192:sxZZRqkz/fas2vqIdpRnFHW6+WNGOWioXYwHcfCHIg5NJ:sxZZLz/fas2vjfHbtdoXVrh
TLSH
T1B132D9116E78A97B4CCBE219BB15BF53E6F9503251941E48EAFC861C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e5cd5643963179b02ac165ba46fd879173908fc9cc427fb3eabf34d18aa4d15a
MD5 ba45f1f70df1f8647939eb6cd8c33c73
SHA1 ff1cbfc8a2f8938ab9be68addb6098647e41d4e6
SHA512 98ac6b387745bb3aa4f4363b2997f855e41c13b2a33f695e6c8870a372e3c49a333c9201cb862c279d2507221851af9e99f03aac8142cf59db9c1d5690a6db39
SSDEEP 192:sxZZRqkz/fas2v7IdpkN0nFHW6+WNhCQg1ZYwEESHIg5NJ:sxZZLz/fas2vkTHb6ZEh
TLSH
T17232CB526A78697B4CCBE219BA14BF53E7F6503251901E88EAFC861C05E7BDD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 dcf0e0c47e0c565d3c06a897b9ddc6c16d8c2ad6d21001b575b573429bed01f1
MD5 d12570d75120de7374c152fc5940679e
SHA1 8ac53ce1fc4c1783bac4135289d2577c18d5cdda
SHA512 83b386c9b4eae532ef0eea87d8e85dd6f6e0816ecf6acd51ab8318eb712c424fef7f7c1cf08dbaa7d5f64f96d1508b937d19e5734720f90dffdff0c8c9b20d46
SSDEEP 192:sxZZRqkz/fas2OqIdpRnFHW6+WNGOWioXYwHBvCHIg5vJ:sxZZLz/fas2OjfHbtdoXVIf
TLSH
T1E822C9126F78A97B4CCBE219BB15BF53D6F9503261941E88EAFC861C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0c4bbd83729ff6a9f1f5193354f4697ecb3cb21a54babf8b5bcce9b172f89d26
MD5 808bd5db2c9e5cd7ee60a7071a2e835b
SHA1 0be9be6ce027bf9f957db0043336b87e9e98ad8c
SHA512 43c32643999b3276030b2c3d1500e300f95b25176effd03f178c5df212c4724b8fa839429b3ec87dc5c68b9a1fa7b163f8d209466e0f4aae4c533608011b18b2
SSDEEP 96:KEG0KXqSqQ4Khqq49+CQSu7F+zKvq7KHCvs7z4gLmOIG2Pko20i:CfnN49+CQSux+ziqICvsX4gLmOIG2Pkl
TLSH
T16291F65575BB82023D3E3B0C9A64CB168A9275A33064EC2B7B6C51754FA7E108EFC4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595d1a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595d1a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 dbe1e06be7add170339daa3f46273e99895fa3fd2c947535cf96a904bb5f4406
MD5 1c871f73f8bab940b6ce9085d686967e
SHA1 d9bc0cb0765e02e8d33a2ed8af106a773e73dd40
SHA512 377c16c13339c6c92145018bf179f28c2136946322493e1c69c886d3ee77c376fb680f4051034aec7329fb52d8a47810a0cc79d3f3e9192266566c4f4c092c84
SSDEEP 384:IZcIhsNM2op+EHf+9OMYDMFuLOOPrXLpe8C/rt7:2h9B/oO7KmOi9Pmt7
TLSH
T14C928F31A9785C275DF6FA85F88726039FF84127E6D43BC4A5DCAB1D04DA6AC031BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2dea0fa10fdf02d1e5491d289c9f542b6c448cdffeeb18dc60d9262296f9f8e3
MD5 feb8232da12ecf852a375f370c4ba09a
SHA1 e8eb0abc3df02d178a0bfc41244b35607c75435c
SHA512 415254f18d536d4eef4d8f895c80b8501ec0dba339f261dbe985b696f5e61244123d182e6bfcf4e91b0f32a5e3e05d7246683cdeb48e5a6c9b5345c4c945e536
SSDEEP 192:EOND6hZ0QmiUyVTpc/+jVfO1SYo25wOZAJL0U6:EOND6oapu+9OMY42y0U6
TLSH
T1F002F93569686C778EE2AE45F48B37235FE4112BA9A52FC4DAEC1B1D00C779C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 8b5e3c32e43960e98537f16b99d256e893ec6f15f2b57b6b1be243504af95167
MD5 ec714e82ab7486b3737317d81017aed6
SHA1 560855593bec40c9781cd17d76fe51c1030ca521
SHA512 d38d3d7740dfe5f2e73bb1808027d0229d9a08e7bfa99302c3bfd6a30390ab6980d9482282f857014a3bf7cddda5243709b35b724f66fdcb2b19c0a017c458bf
SSDEEP 384:SZcIhsNM3op+EHf+9OMYDMFuLOOPrXLpe8C/rt7:ghQB/oO7KmOi9Pmt7
TLSH
T17B928E31A9785C275DF6FA85F88726039FF84127E6D43BC4A6DCAB1D04DA66C031BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 65e34a7ac0862d137c9da8e10582b690905ddfb03792376f07f15e96a8b0e1c8
MD5 74133aaa7745fef4ad0cdf1873e46635
SHA1 bfc43215f9c75f7ba9575d56fd29a55b882c61d1
SHA512 6c80fa76ef5dd00ea5255cdccabb675990e93f4d537828b8ceae4218fc7afc9fe56b9ceef08e0efcddc3495116fc68389f396e6c58ea868c0540f08476d7173a
SSDEEP 192:vONd6hZyQmiUyQT1c/+jVfO1SYoQIee5cOqEqALU6:vONd6CB1u+9OMYDt9uLU6
TLSH
T145120A31A968AC375DE2A955F48735539FE4422BE9957FC4E5DC2B1C00DF6AC230BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 07dd5b674ccc7e26818fec0c42331a3f0609c5e7392ff5741b604f44277cd4c9
MD5 9cd456a7e7f06c68821ad8ebab93b8b0
SHA1 f5210b07a10d311a94c27922bece6c65e2e78d5b
SHA512 e88a5fba7ff4914b602ca2ad0d520bc4625fbf9c976681f7aa19e0c88f9e6bf3e319b9957a4fe59c4e9f3e9dfbb64f406bcca0f348e3641b96f2dd341218ead0
SSDEEP 384:eiFiZcIZsNE8TUNTUlIl3op+EHf+9OMYD4FuLOOPrXLpe8C/rt7:1FQZxwgSB/oO7mmOi9Pmt7
TLSH
T174A27E3299A8993BADF6AF85F95A32038EF44167D5D4BBD4A7DC9B1C00971AC030BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 180b2ba9a35d6e8af58f72b78c2c4b61a13d39ea55dd40f05cdf961faf091836
MD5 a9c068e8cf9030ae7770736911163477
SHA1 8a6370bf88988b43f087d9b524954e7914b4a297
SHA512 7183d147eb43233df332be3d47535c961c1daf0ef1c9a6aedd51ae7cf0f2c8e19ede51f63f5a81da7826164237bdbff439e9beea528879c327f62fac96496b6e
TLSH
T10041E39DA6F91048B3B77E56ABF6A86D487FBC772E07949D10010E4E0A23A41C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads