hxxps://bbfcbihb[.]r[.]bh[.]d[.]sendibt3[.]com/tr/op/ib7QCE8ALSgScKUHzKxnxTefTuu6x_-6lVaYpzmRxN_h4_BS82wvmjmWT6Kdb2BBqfYRR1SfPnlGk1fcGftDgekofDAvGMIfZ3QlSe_j_YlZINRKcckfyai60n-36Nyw8w0FAAeGoSeLfsfxJ0lFN5dEITCJzNrQjK_afylUEL6HdE0im7MuJnS1zhODQn0AXmhdUAhFSYOgto8Cr8d0Pk66Dwdl6TZZ

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/08/2026, 04:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://bbfcbihb.r.bh.d.sendibt3.com/tr/op/ib7QCE8ALSgScKUHzKxnxTefTuu6x_-6lVaYpzmRxN_h4_BS82wvmjmWT6Kdb2BBqfYRR1SfPnlGk1fcGftDgekofDAvGMIfZ3QlSe_j_YlZINRKcckfyai60n-36Nyw8w0FAAeGoSeLfsfxJ0lFN5dEITCJzNrQjK_afylUEL6HdE0im7MuJnS1zhODQn0AXmhdUAhFSYOgto8Cr8d0Pk66Dwdl6TZZ
Sample260815-erwbasen7s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3392	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312406684978292"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{F7646507-ED21-45E6-B438-001E11A4FB0B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
564	msedge.exe
564	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 4792	3884	msedge.exe	81
PID 3884 wrote to memory of 3392	3884	msedge.exe	82
PID 3884 wrote to memory of 4808	3884	msedge.exe	83
PID 3884 wrote to memory of 4808	3884	msedge.exe	83
PID 3884 wrote to memory of 4808	3884	msedge.exe	83
PID 3884 wrote to memory of 1528	3884	msedge.exe	84
PID 3884 wrote to memory of 1528	3884	msedge.exe	84
PID 3884 wrote to memory of 5000	3884	msedge.exe	85
PID 3884 wrote to memory of 5000	3884	msedge.exe	85
PID 3884 wrote to memory of 5000	3884	msedge.exe	85
PID 3884 wrote to memory of 4092	3884	msedge.exe	86
PID 3884 wrote to memory of 4092	3884	msedge.exe	86
PID 3884 wrote to memory of 4092	3884	msedge.exe	86
PID 3884 wrote to memory of 3448	3884	msedge.exe	89
PID 3884 wrote to memory of 2880	3884	msedge.exe	90
PID 3884 wrote to memory of 3448	3884	msedge.exe	89
PID 3884 wrote to memory of 3448	3884	msedge.exe	89
PID 3884 wrote to memory of 2880	3884	msedge.exe	90
PID 3884 wrote to memory of 2880	3884	msedge.exe	90
PID 3884 wrote to memory of 1948	3884	msedge.exe	91
PID 3884 wrote to memory of 2372	3884	msedge.exe	92
PID 3884 wrote to memory of 1948	3884	msedge.exe	91
PID 3884 wrote to memory of 1948	3884	msedge.exe	91
PID 3884 wrote to memory of 2372	3884	msedge.exe	92
PID 3884 wrote to memory of 2372	3884	msedge.exe	92
PID 3884 wrote to memory of 1052	3884	msedge.exe	94
PID 3884 wrote to memory of 3352	3884	msedge.exe	95
PID 3884 wrote to memory of 1052	3884	msedge.exe	94
PID 3884 wrote to memory of 3352	3884	msedge.exe	95
PID 3884 wrote to memory of 4064	3884	msedge.exe	96
PID 3884 wrote to memory of 4968	3884	msedge.exe	98
PID 4064 wrote to memory of 2496	4064	msedge.exe	99
PID 3884 wrote to memory of 1636	3884	msedge.exe	100
PID 3884 wrote to memory of 3012	3884	msedge.exe	101
PID 3884 wrote to memory of 1744	3884	msedge.exe	102
PID 3884 wrote to memory of 2808	3884	msedge.exe	103
PID 3884 wrote to memory of 2808	3884	msedge.exe	103
PID 3884 wrote to memory of 564	3884	msedge.exe	105

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bbfcbihb.r.bh.d.sendibt3.com/tr/op/ib7QCE8ALSgScKUHzKxnxTefTuu6x_-6lVaYpzmRxN_h4_BS82wvmjmWT6Kdb2BBqfYRR1SfPnlGk1fcGftDgekofDAvGMIfZ3QlSe_j_YlZINRKcckfyai60n-36Nyw8w0FAAeGoSeLfsfxJ0lFN5dEITCJzNrQjK_afylUEL6HdE0im7MuJnS1zhODQn0AXmhdUAhFSYOgto8Cr8d0Pk66Dwdl6TZZ
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x288,0x7ffa2e93c188,0x7ffa2e93c194,0x7ffa2e93c1a0
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1732,i,767742675728316130,6367783638052072880,524288 --field-trial-handle=2112,i,8202752789135263929,14727405694993837289,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,4499231772652535297,14648847638305110544,262144 --field-trial-handle=2112,i,8202752789135263929,14727405694993837289,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,3454846737033870727,8480189187413525470,524288 --field-trial-handle=2112,i,8202752789135263929,14727405694993837289,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:13
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,1328812981216721086,6734965673667669791,2097152 --field-trial-handle=2112,i,8202752789135263929,14727405694993837289,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,2134132835732710083,2098643633786786134,2097152 --field-trial-handle=2112,i,8202752789135263929,14727405694993837289,262144 --variations-seed-version --mojo-platform-channel-handle=1556 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4120,i,16035099783194581322,3055768113343306944,2097152 --field-trial-handle=2112,i,8202752789135263929,14727405694993837289,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,10031419266807051252,12592324664694219271,2097152 --field-trial-handle=2112,i,8202752789135263929,14727405694993837289,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:9
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4256,i,11408564250478823167,990360047792999687,2097152 --field-trial-handle=2112,i,8202752789135263929,14727405694993837289,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4268,i,1681793412462220442,16201468774297666874,2097152 --field-trial-handle=2112,i,8202752789135263929,14727405694993837289,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:9
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,1785558863535611076,1687416678331187282,524288 --field-trial-handle=2112,i,8202752789135263929,14727405694993837289,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,12844457747394459130,1504493336665990019,524288 --field-trial-handle=2112,i,8202752789135263929,14727405694993837289,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,16206250382676225143,9242426638385281485,524288 --field-trial-handle=2112,i,8202752789135263929,14727405694993837289,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,17406831550870775850,488437026272129338,524288 --field-trial-handle=2112,i,8202752789135263929,14727405694993837289,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,17406831550870775850,488437026272129338,524288 --field-trial-handle=2112,i,8202752789135263929,14727405694993837289,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,8698641385764943062,457231723383850222,524288 --field-trial-handle=2112,i,8202752789135263929,14727405694993837289,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3452,i,14424487717240772172,17461825281688363665,524288 --field-trial-handle=2112,i,8202752789135263929,14727405694993837289,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,5102066901183728483,15430578837271183666,524288 --field-trial-handle=2112,i,8202752789135263929,14727405694993837289,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,13548460356446797800,216860034926097503,524288 --field-trial-handle=2112,i,8202752789135263929,14727405694993837289,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4952,i,5242704825434191574,4796994174766334637,262144 --field-trial-handle=2112,i,8202752789135263929,14727405694993837289,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:564

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 e8edabe3cea2543420111b0508620c037c6568fc659403876af877c57e7371bc
MD5 4c489541483e88b1e77d6eb7a6b2b3ca
SHA1 8141447de0c4a126cc667b93c448899b277da067
SHA512 efcde0b42559b74982506865860ac163e675e105ffcb92116814fdc907ebf3eb05f62d83355d7f32db666c595ced2ff5daede34be4345e25be3f78c7b2d4fa3a
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7H:fwUQC5VwBIiElEd2K57P7H
TLSH
T1BBB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
MD5 63b4ddb137c55bd42461aacc1eb4cf83
SHA1 e41f99c448526208c80f1acecf1939a8e3f06728
SHA512 88b7f5970c19ff8d8362281bde3b29f3c7b018ff88c03d8ce082f66572704c79543ea528e6962172f18f1cdde2d1aaad0aca218b732ba8a673b844844d3ae585
TLSH
T125D080B23D4DB010D75B51F1F903D741121A857528536B33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
MD5 f7389aaad82eb86ca1896ff3c7af7a86
SHA1 a7833bad037b8c94d375310ccb5bf39c3f9df83c
SHA512 cdfd274480229d612566789a9d9cdf47643a9543e303957436e5121c790936878b1b7eb452100170489121bede724239183c48208033a8c70d6070e93b3f1226
TLSH
T1E5D080B23D4DB010D75B51F1F903D741121A85752853AB33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 361867147be3341087ec1d92dd54a3a0f04fe070590ebf1d15e88de98dbaeb7f
MD5 8f31724ad71d39003cd1194f4f60eccb
SHA1 1c67bb1305465a8c35bc7f10f81ff0f3c0916c13
SHA512 4632cbc68f9a9e5a6d856a7b3aabaf0f47be22b7a3b4e89bc2cf56574353c62d6f3a4c900d7cb8ad24c2fdec2aa731caef8721190eadeb34f27ad35b455b6154
TLSH
T1AE616E21CB2EB7F0F36008B1B2C6A10C3275B0DD396B0E2971D458FDA607B1ED2A651C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4fcc87ae-236d-470c-9f4a-14933aa64f76.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4fcc87ae-236d-470c-9f4a-14933aa64f76.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0f27257dccf77ee3b798b58aa11deb8ee409386a7a316e37a2780cf8fe288869
MD5 d968cffdef7b0796ddbae63cfb94a6b6
SHA1 0553fed63c7a1a2a2b41e4fe911e19bff30dff4b
SHA512 b077a765cf707d45f01a7c3adde36ff5bdc02fb8053a6c01511db34801d8239b8d528cb9be8d852b2ea8aa3c8563aede66505c31e9fc1483f9064b43661bb6bf
TLSH
T16611BBF383E1956EC91066F09A24AE2BCF1C0511821C3C59C9D0AF2793E3475E00295F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6523771bac014a9d3a1fdb7e295c60d88d0941e796b2348bf59f68adfaa7e1d1
MD5 0adcca1a79dff86f3b0860e90c885151
SHA1 1d3cbf1c627806c10d95a36845c44e3c8c769bb8
SHA512 622058b44745295787dd8e38611495f51275d5449e0ba04898c9b0ab37ddb27690c63e11020154c1312014f3a5154bba987c7eb7fcef73905a1be098a137d3bf
SSDEEP 192:sxZeR2yM/jK1Ml8UQNFQ/fAs+TsBIdpbw/W6+WNjJm/Y05vk3pBIg5lJ:sxZesqrQ/fAs+Tsqk/bI/5El
TLSH
T15552F9166674697BCCDBE209F6517F53D6F8057391910E84AAFCDA1C00E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5ec50a1d990cc63e3a04e1eda05386c27431e8522c176b8be1f7bec41af80da9
MD5 e67db7aa12cb49277375572978b88f81
SHA1 f776cfe4afa4ce05bf4b9d5ca6c72cc0d6bd669c
SHA512 29484f616bde34595b7959aa66d1141ad389c919067d1645f60ece963f9c443a1b60576c3ce91b805657b65f3380678b4bbf40b73525f2d151741f66ca5c6f2d
SSDEEP 192:sxZeR2yM/jK1Ml8MFQ/fAsvWsBIdpNw/W6+WNjJm/Y05MUhBIgrJ:sxZesdQ/fAsvWsqa/bI/5L9
TLSH
T1F152E8116B74697BCCDBD209FA517F53D6F8057392910E84A9FCDA1C00E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 58f1cf2b81a1709bb0c22673f396886d25c58334ed81553269c8b50da88e0ec8
MD5 25355a43ac2c1971d5287c457e483d4b
SHA1 897a9d6a2cd648bb09803855f31bf29bd07bcd70
SHA512 1e1eb4d3b2a6e067e8151c5ea18a6ff53dcec9a6f0468b7c39fa56a49da4855e3b29df79490f53bf804b1487c9e597d178329bacc9d5fd0e3073966e08553101
SSDEEP 768:YPzXl8pZ221WRmsYQL08F1+UoAYDCx9Tuqh0VfUC9xbog/OV3u/Ll/df0hzHro0b:YPzXl8pZ221WRmsYQL0u1jaKu/Lpd8hx
TLSH
T1B9E20A3F244CCB7E4F844EACEC266F966ED801CBA6984D5447FA494C03C67EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a0ced67c93d24d66d41365b03e9e18f57f1d5a5eb1d55a8b3d70259208c1d53f
MD5 2c78b3c3cfb0ed48ca55146560e09450
SHA1 65776b25889628e5f5bcbab8624a4426707be937
SHA512 841f550150e20453bd7a02e8da257dba34c1f00b55a423f93906dd347abfe530f7a122fe66f6104b2b3840b11ebaf0b6019552474b162bf5f268ccd5af2461be
SSDEEP 96:KUOkKjCOaqUKjiSiIgKd2yl9lqlpldlXlflB:ajXfjll9lqlpldlXlflB
TLSH
T1969115D570BE02A63C7E2458C3A59726994173A37255ED3B3B6C04760E67E124CFC9CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a1041444a6ca397411b5a49c7272df19ae6fb3daa6954e6a83161e8e41209218
MD5 3bf98e2b73d367f5609c162894b94a39
SHA1 e3587183c8da77aa96339f24b937ee4efa612649
SHA512 7e962a3b212bbb318fdcef2d2e9e5be0c6dfa71e173fd7b63a1939d824a637b51cf930c2760f93be55d1bbbcf0518b6b12398d4091715924c4b24ca68922c6a9
SSDEEP 192:uVP8NNJQKqNEklQmiU1zf8lX4K/GPTkmTF1Pwog7VsAgqwxsAlac:K8NNJ92E6VklIK/+jYoItA5
TLSH
T1B3522A3168F86C3F4DA6A585F4073A079E74515BC6C92FD486ED6B1C05CE2AC230B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 fa44c16a09ab7773564cd75cbc3f0117b64e6b2ea84f7022fe8d9a2fa26032d8
MD5 77db494fc89c91617204b87d1a282a89
SHA1 19b1c01ae9772cb1a7362d07ab9aa1eee1fa9fb1
SHA512 abb1dc0d8f056f7b75e65d7bb0c5e3e3ee3fb1cfe74a40ce4466712077d9304ca6b47eeaedd3d993fba7928da6ae0116325dd9cbd67e73f2c1830d055bf286ce
SSDEEP 384:eZcI58NN192E6VklIK/+jYoItAOOPrXLpe8C/8:c5kdlb/AQtAOi9PP
TLSH
T1AA929E7168F86C7F5CF6E585F4463B079EB84127E6C92FC486ECAB0D06CA19C130792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 52525726a50a3661250e47cf1be24bf6506696ea1fce31907833941098fc8414
MD5 9a2eb544a058be425262a21933cdba8d
SHA1 befa7d09a2e69dda2f11cdeb25bd29a1a2d78ece
SHA512 546f3673121a59b3b4313c5e39e1476189783fc3d2027a5f22c7033a086e2d97b352830cb66fe8b7513ea4cb16c2ad3d5bdff919ca0ff7904f679112c984b52f
SSDEEP 384:4wZcIe8NN192E6XklIK/+jYokZAOOPrXLpe8C/8:3ekLlb/AcZAOi9PP
TLSH
T1D0C218F058E7283AD8AEA743A77E2E035EBCC117B1851A84B7E8560CCDC617FD306825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 13KB
SHA256 74f86a293218817831afc3ae9206bc7a7272301a7aff15061e0cb424900a03d5
MD5 6c789d75fa729274cc5cf33678306f0f
SHA1 009c34805191d27f201479f68b7048edd3d20cc3
SHA512 3a3c823185f274335daaaccefe6dd6133375cbffe526855c71dca6c0fb5dc5eb38cd726a26d1e3f4d35c08fa9ffb28df0bf907b22d07592321037c207422b946
SSDEEP 192:uVt8NNYAQKqNEklQmiU1zf8lX4K/GPTkmTF1Pwog7VsAgqwxsAlac:G8NN192E6VklIK/+jYoItA5
TLSH
T1F4522A7168F86C3B4DA7A585F4073A179E74505BDBC92FD4C6ED2B1C05CE2AC230B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d46701d4d7450708010dc643ab620b8bb714f2961429a10174076a502b396063
MD5 e37d752e4c3de060888cda75e6b06c9a
SHA1 fe9e25d269cd1ff209d8a772b480cc0452918d3f
SHA512 ffcac2fe76fb104da506f7bb84a5d670e1a2b96ee48b21442273a51ded47162c403433973cdff6ba1593b8e483cf2e19a67d062481572c77f664844e17d7632b
SSDEEP 192:7GNB6fNNQmiUyKzHqPL/GPTkmVV7qfJWU6:7GNB61L1zKPL/AUxWU6
TLSH
T1D602EA34ACB8787F8DE2AE49F5473B175FA5212BDA952F94C6E81B1C00D729C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2158f974eb3aa17e69fa352038b09e09b8d6fb2d0f7a38895f7a2f2668283a1d
MD5 99f3aeb7fcdd16d643ed0e755bf38f6f
SHA1 c8164fe9e5d8ab0da4979913249b0720031cba71
SHA512 193679e1faeb5daec18b8b4398d962fb9df2fece96e991effda8c33979cf1d24b2b34d02017ad81576556089c9f8fba9a76fb7b647118c11b7c47eedaab20567
SSDEEP 192:oGNw6fNjQmiUyISq4L/GPTkmTF1PwogcV3ZgqwxU6:oGNw61VFP4L/+jYo9LAU6
TLSH
T196120831B8E8787F4DA2A595F4473A175E64521BDBCA2F84C6EC2B1C05DF2AC130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download