hxxp://finpro[.]kz

Analysis

user interaction
yes
max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://finpro.kz
Sample260818-evjrnsfc77

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1840	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315001542909566"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{ADEA05D8-B943-4289-8964-4AAA4F2C3D28}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
464	msedge.exe
464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 1356	3540	msedge.exe	85
PID 3540 wrote to memory of 1840	3540	msedge.exe	86
PID 3540 wrote to memory of 4160	3540	msedge.exe	87
PID 3540 wrote to memory of 4160	3540	msedge.exe	87
PID 3540 wrote to memory of 4160	3540	msedge.exe	87
PID 3540 wrote to memory of 1728	3540	msedge.exe	88
PID 3540 wrote to memory of 1728	3540	msedge.exe	88
PID 3540 wrote to memory of 2644	3540	msedge.exe	90
PID 3540 wrote to memory of 2816	3540	msedge.exe	91
PID 3540 wrote to memory of 2644	3540	msedge.exe	90
PID 3540 wrote to memory of 2644	3540	msedge.exe	90
PID 3540 wrote to memory of 2816	3540	msedge.exe	91
PID 3540 wrote to memory of 2816	3540	msedge.exe	91
PID 3540 wrote to memory of 3168	3540	msedge.exe	92
PID 3540 wrote to memory of 3168	3540	msedge.exe	92
PID 3540 wrote to memory of 3168	3540	msedge.exe	92
PID 3540 wrote to memory of 4660	3540	msedge.exe	93
PID 3540 wrote to memory of 4660	3540	msedge.exe	93
PID 3540 wrote to memory of 4660	3540	msedge.exe	93
PID 3540 wrote to memory of 4636	3540	msedge.exe	97
PID 3540 wrote to memory of 4636	3540	msedge.exe	97
PID 3540 wrote to memory of 5068	3540	msedge.exe	98
PID 3540 wrote to memory of 5068	3540	msedge.exe	98
PID 3540 wrote to memory of 4264	3540	msedge.exe	100
PID 3540 wrote to memory of 3276	3540	msedge.exe	112
PID 3540 wrote to memory of 3276	3540	msedge.exe	112
PID 3540 wrote to memory of 3276	3540	msedge.exe	112
PID 3540 wrote to memory of 2988	3540	msedge.exe	113
PID 3540 wrote to memory of 2192	3540	msedge.exe	114
PID 3540 wrote to memory of 2284	3540	msedge.exe	115
PID 3540 wrote to memory of 2536	3540	msedge.exe	116
PID 3540 wrote to memory of 2536	3540	msedge.exe	116
PID 3540 wrote to memory of 2536	3540	msedge.exe	116
PID 3540 wrote to memory of 3900	3540	msedge.exe	118
PID 3540 wrote to memory of 3900	3540	msedge.exe	118
PID 3540 wrote to memory of 3900	3540	msedge.exe	118
PID 3540 wrote to memory of 4428	3540	msedge.exe	119
PID 3540 wrote to memory of 4428	3540	msedge.exe	119
PID 3540 wrote to memory of 1192	3540	msedge.exe	121
PID 3540 wrote to memory of 1192	3540	msedge.exe	121
PID 3540 wrote to memory of 1192	3540	msedge.exe	121
PID 3540 wrote to memory of 464	3540	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://finpro.kz
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ff947f6c188,0x7ff947f6c194,0x7ff947f6c1a0
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,12131463700100642235,11086450257273931244,524288 --field-trial-handle=2264,i,12696281636521840139,17074135281833456459,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,13635401639875421352,5594569738443077877,262144 --field-trial-handle=2264,i,12696281636521840139,17074135281833456459,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,11688792396007121715,3261599829305157893,524288 --field-trial-handle=2264,i,12696281636521840139,17074135281833456459,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,12867233187208053601,14579926653409164853,2097152 --field-trial-handle=2264,i,12696281636521840139,17074135281833456459,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,12965264998410247292,9390156771003206822,2097152 --field-trial-handle=2264,i,12696281636521840139,17074135281833456459,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,13570787051247073082,7604139574075182254,2097152 --field-trial-handle=2264,i,12696281636521840139,17074135281833456459,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,11983502745409967295,6222929150391102831,2097152 --field-trial-handle=2264,i,12696281636521840139,17074135281833456459,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,265798601308379202,1088954896224924938,524288 --field-trial-handle=2264,i,12696281636521840139,17074135281833456459,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,17420658439075710352,12970601446114411368,524288 --field-trial-handle=2264,i,12696281636521840139,17074135281833456459,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,6184090637620636376,1002802630748312198,524288 --field-trial-handle=2264,i,12696281636521840139,17074135281833456459,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,6184090637620636376,1002802630748312198,524288 --field-trial-handle=2264,i,12696281636521840139,17074135281833456459,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4308,i,1499707838016538857,6562704847647065128,2097152 --field-trial-handle=2264,i,12696281636521840139,17074135281833456459,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,1788958922691687226,17579635029260829905,524288 --field-trial-handle=2264,i,12696281636521840139,17074135281833456459,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,12656638761678206132,17724451607290131754,524288 --field-trial-handle=2264,i,12696281636521840139,17074135281833456459,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,139598382645027778,14270382955589741508,524288 --field-trial-handle=2264,i,12696281636521840139,17074135281833456459,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3548,i,10721067014487702296,11081167920917972722,2097152 --field-trial-handle=2264,i,12696281636521840139,17074135281833456459,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4188,i,11099134789993846339,5572107399013938427,2097152 --field-trial-handle=2264,i,12696281636521840139,17074135281833456459,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,3863380867535444809,1010081400375069636,524288 --field-trial-handle=2264,i,12696281636521840139,17074135281833456459,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4436,i,9535958133744527669,2454010487150906729,2097152 --field-trial-handle=2264,i,12696281636521840139,17074135281833456459,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5708,i,14112085848495960082,11208408198551210141,262144 --field-trial-handle=2264,i,12696281636521840139,17074135281833456459,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c07519d6166a7c6d897e2733bc52f1e816a33528b44913d4a7794b409a429ce6
MD5 489a97652d566f1c7b89fb5528298ba0
SHA1 37eced279d02d41a0516d84c498d0f8937997b4c
SHA512 6996aae2a69e5d901237aa5ce22157a245bb631eb069a1482fba7e23fcf0b8a35d866dcb6657fb6b4f904d2ff901821adc4d538bc53f4e69b19cab08c836725a
TLSH
T13381D7F52A3200A4E720057D94F96E2A3A75A7EAFB0B5F5A31807C706D16FF20069D3C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587848.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587848.TMP
Size 3KB
SHA256 7b7188f17415559ac774d6262978a9e949afd795c1197c10ca33820b2931568a
MD5 e0b4904b79790b910b96a46c71158587
SHA1 303afdf11f9addad418b05d4105c4dce33134255
SHA512 820330eaa32b439c7e22fecb8f0a871454fd4407b393dcc1022933d41c125e342185a52e49aa64b40c6c8a82458eb46bd409b116169fb829e9ea308b1f4c3853
TLSH
T18281D7F52A3200A0E720057D94F96E6A3A75A7EAFB0B5F5A31807C706D16FF20069D3C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 57e4c788c73d3cae2e50537310be0c30fd129591d003e8b9f9a1bd8a2e039af3
MD5 c9987265e129ffd831240ba716f20c42
SHA1 a6e70f7de7b0d99aebf8776cd8dfa5231e4b0682
SHA512 b7b7738a1a2efe9c99f8dd5dd9cd4b0b79f3b6fbc6150a8de81fe94098a31b50acc3a51dff9de30b8e876899a22d7100848a8962275a53d42e3f782dbd1e3d2f
TLSH
T115115BF3C3D595AE890117F05A28AE2BDE1D0615431C7C1589D4FF6B93E3475E00295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b77f336d917f4162b1c3d2cefd87ecaab06833ad4ebbb32a9eb8affdd1da6f0b
MD5 176343e78dc3206eb069a8cf821b6199
SHA1 916d803a493dd2b5381127a81e4c924c9cba1b2e
SHA512 34535bf0f9a3498428b0e153f8c67c5f8ce3c8f68873170f4e4f5634ad109b24cea88ded134570a5b07277d8944b3af88e4bf146cb3d570380cbf259dec21efd
SSDEEP 192:sxZRRXyM/jK1Ml8Mkb/fLsu6oV1IdpJHwI56+WNGYvxAjh6IgrJ:sxZRjMb/fLsu6NJHCGZs9
TLSH
T11A42D8126B34A977CCDBD209FA55BF53D6F55472A2900E44A9FCCA1C04E6AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 23fe575b70cdebe6427e8a7879b4715bfd2504a712fb7935f9e7ba96a34fc493
MD5 a326c507e53445353afc80e95803472c
SHA1 7689993c34ad0e5eb1ea6111f3d1cffc7e50a497
SHA512 26c444b7f377d63d0364d3b228e46966702969943f0e089ee9586d0bf08b279187d08cbcaf503c930bb6dab40635aa18d841ac0b3daa507ddae0df48af4c892c
SSDEEP 192:sxZRRXyM/jK1Ml8UQ1kb/fLsND1V1IdptfT0HwId6+WNGYvqXjh6Ig54J:sxZRjq+b/fLsND2VQHeG9s2
TLSH
T10C52D812AA346A77CCDBD609FA41BF53D6F55472D2900E44AAFCCA1C04E7ADD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e1094484ff49d41a4a79923ba99da67add8b2a785e6491bf37454ad86d47b879
MD5 9096c8c37d9c6fbee5b5c6fb1a44acee
SHA1 05d2bd46d3cd40868f281bf78f80e6e89e075eae
SHA512 b16211e88d05fb55fa4e700cc1736ff29a1597874e0f1249306fd82b914bacba6f541d0e0341ec9fa1d8899004af0d2000e75300baa3146dd41639d76c3be512
SSDEEP 768:gSseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pp3roI8:gSseJ3xWvhfynu1jaVcL88pkb
TLSH
T161D20B2B280CCB7E4F844E9DEC266F966EE801CB57984D5487EA884C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8fd7911329ca4b79935bb3af358fe8ee1d0ad972a7b9c42eec72c24e58154eda
MD5 83c95091d58954ead2b98aeda31bd7a8
SHA1 e397d69faacb9f557ef586b7939bafc178e90138
SHA512 341598617d3de3341901afd0b1f9beabd2efb0aa1aed57fdad3c1d049e43ea4a7f6943b6b42b832a1377d9d3b0c57dc408877bd20a113fb472d9d68710e5f6aa
SSDEEP 96:KYH+KggmSRkVBnTfkvTqP1ZkK9B1/kJhBKnh5eleKm0xAV:49SRkVBnTfuTq9ZdB1/+hBKnh5hx
TLSH
T186A13446353F02022CBE244DA2EAAA765F4175A33554A4FF7BB844A30E66E110DFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe591803.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe591803.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 2e39a663fa94abb174a1d71a52dd7514075cc94002286da72fc387bf17565a17
MD5 7f00928addbd1938cbca99520d74a69e
SHA1 9b2131479ecc0d32ddfc10a2832e1f3cdbe9c160
SHA512 fac40fef205ea2c9c045254e53f2b505b9f76259f0dd7e7e6be96b44e6da15493db8e31901370ee1a6050faa7c20f4f185159f0fa006cd0cfb578b878de584a0
SSDEEP 192:urm+xasuheOwQxMGsNFP8Q4MndmAM7le6QmiU1ndN4MTq4+FdLkxdtSJr38z1/qk:1ZcIhsNF0zsy7427CJd4xGJr8BZ2Q
TLSH
T178625C72AC346C3BA9E7F682F48A32135FF8C06797C45B94E5EC7F1D00D96A8131A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1d4ae0e8c221ca18baa18a9cfb94442b7ffa7e1b69b34ebb3d3a818b04da8c18
MD5 c7404eacf2d4a2bc99c7866b9e685237
SHA1 6d1b7fe6f23fdcd3333ed67e1d0d715c48970ed9
SHA512 c0a9e09f0c5572dbf170cabf39840201457f8e452eb8129d58b8a52a46150247d238b1161f03f3432ede94d0bbb801ac5f483a72162763eceaf76b2c53d3d932
SSDEEP 384:piFiZcIrsNf8TUNTUlIlNzsy7427CJd4xGJriBZ2Q:AFQr2wgvsyXUzhiB0Q
TLSH
T1EC824C735C54983BADF7BB81F94A32139FF48067D6C4AA94F6DC6F1D00DA1A8130AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1b3def690b8a6c13e8f70d094676ff8d9a282d3124ee3cc270f0c1eaf7cdd6b8
MD5 45964e15c2aeec3e044faad20fd85984
SHA1 d698937819422521bf9cc7a844ccb1ffc6f4ea6a
SHA512 9dd50734f36513441934f8622c98b418979e74e446786ea3a1d37329e6aed12dff7b70c5bb2b8e83a8f169e48fa34290eeacbb3457cd399df8e6f39c65bfd3e8
SSDEEP 192:lON7Zh6vMtPQmiUyj4ThTq4+FdLkxw847M64U/u:lON7D6UtR/TSd4xKiU/u
TLSH
T16F020935AC786C6BAAB3AE46F48A37171FE4117FA5D01B54EAE82F1C00D765C2307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 d46ee94b3aab91ff09a67dd7189f10c9da7a5c05f942a3b0e1800dc92542172c
MD5 1f8ee2d9f34be97dfb407ac0c8e129fe
SHA1 81bb676f4a954d565d15f564bd40cb8c63cc7cb5
SHA512 1e85eb66424722b5f6dceaa0b9c1c94d104ab02386f6a0e1a66438726418bb35cb814fa72a327e245f6e231057474072dd0484256379f6d99fff82fc2f953a77
SSDEEP 192:ukm+xasuheOwQxMGsNF68Q4MndmAM7le6QmiU1ndN4MTq4+FdLkxdtSJr38z1/qk:mZcIhsNFNzsy7427CJd4xGJr8BZ2Q
TLSH
T1E8626C72AC346C3BA9E7F682F48A32135FF4C06797C45B94E5EC7F1D00D96A8130A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 b464f439ecf42161117120fcb518e2cb4c947d4174537dd01d2619a18c51d6c4
MD5 1a7bc35ed77a4b59c1de546781e77d00
SHA1 885ec1d7d41fc2dabe812c73c96861edfeb18627
SHA512 d0f85fea20d7ebd4cb4b76acfdacccd129d845c73678495f2496327b6d54d10978fe9de5d8f1f5d71c9c13bb0656449f7d54e9b411a511951a706aec66da8e15
SSDEEP 192:9ONQ6vMMPQmiUyw4ehTq4+FdLkxdtSJrS80I/q6U/u:9ONQ6UMRaeSd4xGJrbBU/u
TLSH
T12A120C32A8649C2BAD93B646F48B32175EF0C16BDEC46B94FADD3F1C01DE66C1306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d64d7943-9842-4582-bc5f-2b21b92e5c6e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d64d7943-9842-4582-bc5f-2b21b92e5c6e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7e394b4880493e4a94a5f0bb60015bde8226f7cb5f1d3ae270624cc8bd75a69a
MD5 a00388b5f49e45a644eb76da84003276
SHA1 589789cbc26099fe515ec8ea7409586d345b6044
SHA512 a59269fcc9f2408ad9debafab6a1e39b753726789101693614eadbb3ebdaea1a7afb72dbf4493d7791c874ce701f3b76895e778ed0325c710d5735400490f8e6
TLSH
T187412A58A6E91148B3776E5A6FF6A82D447BBC772F4BD45D00010D4F0A27B40C9A2B37
MD5 SHA1 SHA512 TLSH

Submit Download