hxxps://u38081905[.]ct[.]sendgrid[.]net/wf/open?upn=u001[.]BijWyGR1xvGrwpgePVHJgj1QJAYAPa-2F3UhbJDBbULedVVFQjOX-2FmtFoFDlQHJHAy7rebbeYxKFpUaaPpnK-2Fh1AmTBlM3TEJzdV7Z46bE0pTdK6PEqZkW5PdM-2FbNMMvamRAiw3uWaSQ5WLNeSMDzWx7R8jEyJaDQfer1BN7-2Bofehwe8ZeBuK62C-2FFguvc4ryzx2ZgZV1Bh6DYMwycBnyykw-3D-3D

Analysis

max time kernel
148s
max time network
123s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/08/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://u38081905.ct.sendgrid.net/wf/open?upn=u001.BijWyGR1xvGrwpgePVHJgj1QJAYAPa-2F3UhbJDBbULedVVFQjOX-2FmtFoFDlQHJHAy7rebbeYxKFpUaaPpnK-2Fh1AmTBlM3TEJzdV7Z46bE0pTdK6PEqZkW5PdM-2FbNMMvamRAiw3uWaSQ5WLNeSMDzWx7R8jEyJaDQfer1BN7-2Bofehwe8ZeBuK62C-2FFguvc4ryzx2ZgZV1Bh6DYMwycBnyykw-3D-3D
Sample260818-e6stqawcrc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4412	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315012217733044"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2043432456-1617298091-2772621413-1000\{DBD88D5E-4594-48E8-9704-33C5B0228F8D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
436	msedge.exe
436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 2408	4548	msedge.exe	80
PID 4548 wrote to memory of 2340	4548	msedge.exe	81
PID 4548 wrote to memory of 4412	4548	msedge.exe	82
PID 4548 wrote to memory of 2340	4548	msedge.exe	81
PID 4548 wrote to memory of 2340	4548	msedge.exe	81
PID 4548 wrote to memory of 1176	4548	msedge.exe	84
PID 4548 wrote to memory of 1176	4548	msedge.exe	84
PID 4548 wrote to memory of 2092	4548	msedge.exe	86
PID 4548 wrote to memory of 2092	4548	msedge.exe	86
PID 4548 wrote to memory of 2092	4548	msedge.exe	86
PID 4548 wrote to memory of 1868	4548	msedge.exe	85
PID 4548 wrote to memory of 1868	4548	msedge.exe	85
PID 4548 wrote to memory of 1868	4548	msedge.exe	85
PID 4548 wrote to memory of 4276	4548	msedge.exe	87
PID 4548 wrote to memory of 4276	4548	msedge.exe	87
PID 4548 wrote to memory of 4276	4548	msedge.exe	87
PID 4548 wrote to memory of 952	4548	msedge.exe	88
PID 4548 wrote to memory of 952	4548	msedge.exe	88
PID 4548 wrote to memory of 952	4548	msedge.exe	88
PID 4548 wrote to memory of 2532	4548	msedge.exe	89
PID 4548 wrote to memory of 3140	4548	msedge.exe	90
PID 4548 wrote to memory of 2532	4548	msedge.exe	89
PID 4548 wrote to memory of 2532	4548	msedge.exe	89
PID 4548 wrote to memory of 3140	4548	msedge.exe	90
PID 4548 wrote to memory of 3140	4548	msedge.exe	90
PID 4548 wrote to memory of 5552	4548	msedge.exe	93
PID 4548 wrote to memory of 5348	4548	msedge.exe	94
PID 4548 wrote to memory of 5552	4548	msedge.exe	93
PID 4548 wrote to memory of 5348	4548	msedge.exe	94
PID 4548 wrote to memory of 5716	4548	msedge.exe	96
PID 4548 wrote to memory of 5696	4548	msedge.exe	97
PID 5716 wrote to memory of 6112	5716	msedge.exe	98
PID 4548 wrote to memory of 5828	4548	msedge.exe	99
PID 4548 wrote to memory of 5840	4548	msedge.exe	100
PID 4548 wrote to memory of 3908	4548	msedge.exe	101
PID 4548 wrote to memory of 4112	4548	msedge.exe	102
PID 4548 wrote to memory of 4112	4548	msedge.exe	102
PID 4548 wrote to memory of 436	4548	msedge.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://u38081905.ct.sendgrid.net/wf/open?upn=u001.BijWyGR1xvGrwpgePVHJgj1QJAYAPa-2F3UhbJDBbULedVVFQjOX-2FmtFoFDlQHJHAy7rebbeYxKFpUaaPpnK-2Fh1AmTBlM3TEJzdV7Z46bE0pTdK6PEqZkW5PdM-2FbNMMvamRAiw3uWaSQ5WLNeSMDzWx7R8jEyJaDQfer1BN7-2Bofehwe8ZeBuK62C-2FFguvc4ryzx2ZgZV1Bh6DYMwycBnyykw-3D-3D
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ff97fa0c188,0x7ff97fa0c194,0x7ff97fa0c1a0
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,7800376015159362963,3868579307286815831,262144 --field-trial-handle=1984,i,4344083071488977827,3735677922316054521,262144 --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,17076672239995886270,16811093947573864976,524288 --field-trial-handle=1984,i,4344083071488977827,3735677922316054521,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,12546615228851860211,9097649620923731795,524288 --field-trial-handle=1984,i,4344083071488977827,3735677922316054521,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:13
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,10926131481969024336,7129145197985222873,2097152 --field-trial-handle=1984,i,4344083071488977827,3735677922316054521,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,11876139250102254186,18419392473567260920,2097152 --field-trial-handle=1984,i,4344083071488977827,3735677922316054521,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4112,i,17742883771994680651,14187485176359184749,2097152 --field-trial-handle=1984,i,4344083071488977827,3735677922316054521,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,3392750283493256339,2165157538609130964,2097152 --field-trial-handle=1984,i,4344083071488977827,3735677922316054521,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:9
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4180,i,17881205594316357596,995368391580304819,2097152 --field-trial-handle=1984,i,4344083071488977827,3735677922316054521,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4344,i,16219727058003304593,7047018865788980721,2097152 --field-trial-handle=1984,i,4344083071488977827,3735677922316054521,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:9
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,13806695660427141812,5328682373292638049,524288 --field-trial-handle=1984,i,4344083071488977827,3735677922316054521,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:14
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,17243011581378832755,10968600254783817443,524288 --field-trial-handle=1984,i,4344083071488977827,3735677922316054521,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:14
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,17175877660014771194,3074059181091934257,524288 --field-trial-handle=1984,i,4344083071488977827,3735677922316054521,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,11829168997230544666,3623313682501570131,524288 --field-trial-handle=1984,i,4344083071488977827,3735677922316054521,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,17175877660014771194,3074059181091934257,524288 --field-trial-handle=1984,i,4344083071488977827,3735677922316054521,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4156,i,13689863209606340227,6514302465794898491,524288 --field-trial-handle=1984,i,4344083071488977827,3735677922316054521,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:14
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4204,i,16950518061358965318,6412633372101858258,524288 --field-trial-handle=1984,i,4344083071488977827,3735677922316054521,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:14
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4172,i,9632218272852069055,3064368897879657562,524288 --field-trial-handle=1984,i,4344083071488977827,3735677922316054521,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,9595826737990852814,14828430861449800653,524288 --field-trial-handle=1984,i,4344083071488977827,3735677922316054521,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:14
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6552,i,12309776751650336149,7273666152833562786,262144 --field-trial-handle=1984,i,4344083071488977827,3735677922316054521,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dcfc4c476f41db2d6042449b7b855b9751140e2127be8e8208aafd46a5893b7d
MD5 08e448ed3ad1512fa216c2eea50fff9a
SHA1 2d684e6af180cff0b8adea283dbb0c009102fc3e
SHA512 f9ebe4d980c84e665fbd9643a31fbc7a6b08028d289cd54ea7400acc1d6a7d231dd7952c9c49775207225efebf00cdaaf6a2b295dbeac8f234ed7bdfa52c4693
TLSH
T122D0C073050D0000EA0D41312073C7050313BB210E013C03B855F8381D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 89ab71a3a4e732da8cbbe2e13ba149e13c94226b7119c8a0598106b99907544f
MD5 ca938be236bc251b79a4ee9dbf06dd19
SHA1 2ed95a78846a95a90b8d9b70e9cdc6188f0ce608
SHA512 caf4662a529a373a26b513e285938286f3af46a8729fb4c0be324b084fdba1e10dacca4b8f67585c4a5c6683f45dc7e259548eaf3ffb985905aeefbb7225e0e7
TLSH
T124D0C073050D0000EE0D41312073C7050313BB210E017D03B855F8380D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 67174ea7647fc45735a5f85c79b2815fd6a8142813b331828462262666a2b4bc
MD5 7550e84a7a98075dadaef9ab02a95447
SHA1 60be7f5915379c11089a091298ac858b7ff49d44
SHA512 f731a36be7eb12b1e76bbf160b2536bdf65a0f7bf305b43046004d8b90813a4a1b60daef7c1bea4b91b40239b2b0fb598a1475ffc6d4ac913c82991ee96ea58b
TLSH
T1F9715DD402C23867EB50413D80D70A0974BEB5D63B276F527264A4F62B1FF62D466F38
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe583350.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe583350.TMP
Size 3KB
SHA256 74c1af84a6f51d3c0ac7e20f2d108dd96269b91550603f6e32201afc48affaa5
MD5 8d524e92459e5514825b715bfcda2f27
SHA1 a34e06fe09f8dbcb7b03ab046752137ab733888e
SHA512 2857b0cb61f7d772780b23896a8e73f5e6cfb2af4836823e16a34b106618b3305eabac799b5eae22ded0bdf0d37f94acbc1d2c048c60f72aabce7b09b1fe53cd
TLSH
T1D6715DD402C22867EB50413D90D70A0974BEB5D63B276F527264A8F62B1FF62D46AB38
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 a8e944e695669a5f6867b56fc51f44c96498ec8a707601ba8e1efab5f0297743
MD5 395f27172fdea61547ddad507504a846
SHA1 40302e8fade87e104318fa8ba50a69d94396ada6
SHA512 4a7321b39b5cf626871b9f6e68dab9408b9a1a3c00c783835e299fd8994bd4e1c3cb3a4bf1a4484851d792de21aa43bc8d4956380cc9e92e08664e49c2bb217f
TLSH
T15B117AB3C3D585AE890126F05A28AE2BCE2D0606822C7C19C9D4EF2B93E3475E10255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0420f5d79e5b346e88aecf2b73c108b17af468be359bb9d4143c8fc1cd0a3100
MD5 e1ddc6e657ca62bd54be482ca16ca1b1
SHA1 0418054222180e87da461b757e943fd87ab6e229
SHA512 5b2f683236bf73ea8d10c8e9b6609b025663dfdcfdbe9970f1856bec58fa9a984e754aab3bdd89d07a698375b17e26fb7eaba9613b6d110f54c3c78a1f54ba6d
SSDEEP 192:sxZERAyM/jK1Ml8UQNFH/f/s1gEIdpnF/W6+WNvns/Y01awePIg5EJ:sxZEiqrH/f/s1gdF/b0/5O2
TLSH
T1FA52F951AA345A77CCDBE609F591BF93D6F94472D1900E44ADFCCA1C04E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 09b0aefc1b34406e6a8e159515b1fb1a2349315a4eaccddde2fabc7173be6863
MD5 98771c6b46becd538df1f033d2ac6324
SHA1 9f441431c61bd4563bfd5b4c7c2e7bf4ecca7176
SHA512 0a7b7fd4dfcb3a94dec1f3c686b37a45885fa078d927b4a5d11d0f5147222679b8ad765643734c31dc7bcddc7b11bfba1e4b1c6abb1ca172911c8bff28b6b1e0
SSDEEP 192:sxZERAyM/jK1Ml8MFH/f/sLBEIdpNF/W6+WNvns/Y01qXcPIgrJ:sxZEidH/f/sLBdH/b0/579
TLSH
T11152F851AA34AA77CCDBD309F955BB93D6F94572D2900E44ADFCC91C04E6AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 442f112317cbc22e88a9dd8f2b88116bbda17cf378416de6b7df75bbe75347ab
MD5 4ba437b259cec2c1dd5eb8be37142f87
SHA1 a27c2115f5e32d4eeec2be8381e073c184d73620
SHA512 69995954a8227853076452985eb2267b62c5cbe42b710d6fd9beb18eca52c998bbf2d8e1b88939071c68a0821ac209cdd3031903752bf2540033c5e54bc60188
SSDEEP 768:4d4bSV4b+8b4bm254bRWRmG4b/QB4bH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3c4K:42u+68si2y1WRmlzQqju1jaKDILpZ8Uj
TLSH
T1E7E22A3B280CCB7E4F844E5CEC26AF966ED802CBA6684D5447FE494C03C77EB511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ede80ba50676e32a681e06c5a1c44dabce700a179ff25395b9971d1ba6ffc4be
MD5 c19ad067dc5ad155c3d6f6300793a76d
SHA1 e58983c2afe93a8de63a4aac81a5bc9897e4cd88
SHA512 a2d119e99cfc327510864bb5c216e5dfd4c58cee9ffa9cb8630873e400d111379cf8ba4b807c75ae49633fb0447477ae00a1f91f4517eb3d074d5924b97d4dee
SSDEEP 96:KIZOKCcSErAfLpBx2DBW9xL2K5Txt29Tred9vuKQ42G:8dErAfLpBxSBWLLbTxtGTredcNG
TLSH
T15991904235BA82013C7F793892E6DB275A8275673508E43BBBE814A20E67F101DFD9CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

baf8e80b-b73a-4ce8-8903-4751e98d91bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\baf8e80b-b73a-4ce8-8903-4751e98d91bd.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

62394d71-aeb1-4f2b-a6e5-57e139b8a64f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\62394d71-aeb1-4f2b-a6e5-57e139b8a64f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 0078dac5d96c61070b5caf23c74dd0349f43b8f6573d3c413cefa38dce40eb88
MD5 1869a9b9fed1fc1b8c059f4418e1a6cb
SHA1 fcd146806ee2489344aa476bad22bece4e6bab5b
SHA512 b632bb475665c66985333f3879f6ea858ade7b73deb59bcbd08a4d881806ab1e16a6632c2963ef079997026344bcc421df5bb16a4f9ac70afd8d2af1e50b441e
SSDEEP 384:bZcIK8NylDxOHrbr3b+AD82hmXsb+2AXHA/ySllYJTfY81FJSvBuu:DKOnrpxGqlAXA/ZuTHLABuu
TLSH
T103926C725C649C7799B7F645B88B35074FF8812793C9AF80C6EC6B1E019B5AC131B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 40c7492a925ed27fc4d01924c669fb766afe0c027286048fbd5786766099cbae
MD5 314da666ea031985bc76811035780066
SHA1 7a0f2bb2cdc6bcd9a2c97fc22868efd1332257c3
SHA512 e53e80ce88ec6fc34908dabca8c4189c9aa0ee28c03e172621e87273265ee95727fa9293ab91fa686128600fb2023d9050df6f14c1a084e4058e8cc65b4084c2
SSDEEP 384:FZcIK8NygDxOHrbr3b+AD82hmXsb+2AXHA/ySllYJTfY81FJSvBuu:9K/nrpxGqlAXA/ZuTHLABuu
TLSH
T180926D725C649C7799B7F645B88B36034FF8812793C9AFC0C5EC6B1E019B5AC031B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5a6d7baf42f84e7fa22ed52cbac745677422a51a0f541c1a278a9f167bffc035
MD5 cd47f62acf7006ba55c2848c45260a1b
SHA1 f8e56c5feae4fc3545d2dad2699a613915a5e8c4
SHA512 c2978ea6a43eb87add204daeb71a7b8388754fa2264bdb8890fabe0fe02af6d4996564dfdd2a05cad7f9b2c1509cc6234d46edc69954d30ebaa497a84bc4787e
SSDEEP 384:ziFMZcIb8NK8TUNTUlIllDxOHTbr3b+AD82hmXsb+2nXHA/ySllYJTfY81FJSvBH:eFabbwg+nrpxGqlnXA/ZuTHLABuu
TLSH
T128D23CF208D78476D9AE9747B77E2D034EBCC067B685AA80B7D85A1DCD460BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 70b186f9243042d38b9c3914256f188a326bfcbd87a00f52dd21839aad0c311e
MD5 475697dceabd140d96f4fa7753bf3aef
SHA1 59bcff3a8f70eb4b377cb4f9c213a3647601c15b
SHA512 7fed7eaba39d7967ea2af122a5af128f79c8f9dfaabf81d34517c374ca241156d2510fff87d3e103a534aad59148ee5639fcc094f7475146f853ed128cf0ab77
SSDEEP 192:1GNz6yvQmiUyr0D5Y3b+jcTjzorrifRzmXsb+2tH4MXHKqo/U6:1GNz6IH5Y3b+AD82hmXsb+2TXHA/U6
TLSH
T14912FB32A868AC775EE2AA85F48731139FE94127DB89BF80D6EC2F1C05DF55C134E816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 85ccd1e504e5dca0ac776aa0dd9ff2155bff9bffc253b212cab4d0db867e34f1
MD5 5aad2e03a969122cfee73555b85144be
SHA1 803bf0bb3ebdb04a13ee4b3115c4f97e477b1344
SHA512 61b6ca379095c158e612195188dbf3dc049c6b315e1105aeb953b17d76ce54736e3972517532164a095580e878cb78e9afa77464f1e465cf860e8d186eaeb56f
SSDEEP 192:nRGNK6yMQmiUyKJmD1Y3b+jcTjzorrifRzZMnXHIPVU6:RGNK6x1s1Y3b+AD82hwXHWVU6
TLSH
T12E02D835A8786C7B9FF2AE49B48737139FE4112BD9952F80DAE81F1C00D765C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 8fb5c37eafc82434bc6247e1c28845690effe56568ccd6762c766ce77809b640
MD5 9ae840fd4b920cb972b1322ea3acbfa6
SHA1 a6b16321d185ddb40842e8c6ecc39cad71d24aee
SHA512 df3384c6f91303c90b9a414a5a8d7b7099b6efbed1fee272ce0747502e5818f59925bca5f67c2d160fa864d15afc8e5c9baf1562783e9e25bd413cebc414aa3e
SSDEEP 384:xZcIK8Ny8DxOHrbr3b+AD82hmXsb+2AXHA/ySllYJTfY81FJSvBuu:ZKPnrpxGqlAXA/ZuTHLABuu
TLSH
T108926D7258649C7799B7F645B88B36034FF8812793C9AFC0C5EC6B1E019B5AC031B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13ed49e9-5a8d-45e0-9b71-55611cf28abc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\13ed49e9-5a8d-45e0-9b71-55611cf28abc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download