1b52f48579c506934e1bf88a2e16f209421230897f68872b9a1dc81d448336ef

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 06:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 246B
Sample260821-g1dhysvbpc
SHA256 1b52f48579c506934e1bf88a2e16f209421230897f68872b9a1dc81d448336ef
MD5 bacb70c231ab862e15efe124c4453d9d
SHA1 c35b31cff42537d98c730ae980231b98bbfae4f3
SHA512 d078ac4c8349caddc2811aad9caad7238e6ea1f68b6ee263fb4f1fef04eae764598a8f0cd958897738a3bdd2412b823bb6b44e45150a8eb2e88676f983164ebf
TLSH
T1FDD0A7B71F404C0405B2A7B40E86F24CBC5310A712115541F1CD75233F2572ECD636C0
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4320	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317665684387688"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{7F069672-41F3-43AC-8569-12858FFEBB68}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
244	msedge.exe
244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 5252	2548	msedge.exe	89
PID 2548 wrote to memory of 4868	2548	msedge.exe	90
PID 2548 wrote to memory of 4320	2548	msedge.exe	92
PID 2548 wrote to memory of 4868	2548	msedge.exe	90
PID 2548 wrote to memory of 4868	2548	msedge.exe	90
PID 2548 wrote to memory of 464	2548	msedge.exe	93
PID 2548 wrote to memory of 464	2548	msedge.exe	93
PID 2548 wrote to memory of 5156	2548	msedge.exe	94
PID 2548 wrote to memory of 5156	2548	msedge.exe	94
PID 2548 wrote to memory of 5156	2548	msedge.exe	94
PID 2548 wrote to memory of 2468	2548	msedge.exe	95
PID 2548 wrote to memory of 2468	2548	msedge.exe	95
PID 2548 wrote to memory of 2468	2548	msedge.exe	95
PID 2548 wrote to memory of 4172	2548	msedge.exe	96
PID 2548 wrote to memory of 2508	2548	msedge.exe	97
PID 2548 wrote to memory of 4172	2548	msedge.exe	96
PID 2548 wrote to memory of 4172	2548	msedge.exe	96
PID 2548 wrote to memory of 2508	2548	msedge.exe	97
PID 2548 wrote to memory of 2508	2548	msedge.exe	97
PID 2548 wrote to memory of 6108	2548	msedge.exe	98
PID 2548 wrote to memory of 6108	2548	msedge.exe	98
PID 2548 wrote to memory of 6108	2548	msedge.exe	98
PID 2548 wrote to memory of 1856	2548	msedge.exe	100
PID 2548 wrote to memory of 1856	2548	msedge.exe	100
PID 2548 wrote to memory of 4572	2548	msedge.exe	101
PID 2548 wrote to memory of 4572	2548	msedge.exe	101
PID 2548 wrote to memory of 4572	2548	msedge.exe	101
PID 2548 wrote to memory of 4552	2548	msedge.exe	102
PID 2548 wrote to memory of 2624	2548	msedge.exe	103
PID 2548 wrote to memory of 4552	2548	msedge.exe	102
PID 2548 wrote to memory of 2624	2548	msedge.exe	103
PID 2548 wrote to memory of 4780	2548	msedge.exe	104
PID 2548 wrote to memory of 4884	2548	msedge.exe	106
PID 2548 wrote to memory of 1000	2548	msedge.exe	110
PID 2548 wrote to memory of 3752	2548	msedge.exe	111
PID 2548 wrote to memory of 2376	2548	msedge.exe	112
PID 2548 wrote to memory of 1716	2548	msedge.exe	113
PID 2548 wrote to memory of 1716	2548	msedge.exe	113
PID 2548 wrote to memory of 244	2548	msedge.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffb7404c188,0x7ffb7404c194,0x7ffb7404c1a0
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,5747544151870117462,11206080064078606987,262144 --field-trial-handle=2624,i,6223531588125725186,5066073236665195987,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:2
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,16116726793818018683,12237151665718391393,524288 --field-trial-handle=2624,i,6223531588125725186,5066073236665195987,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,8655357077924383102,13178584442289773986,524288 --field-trial-handle=2624,i,6223531588125725186,5066073236665195987,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:13
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,7085206926237752709,16343869907998902936,2097152 --field-trial-handle=2624,i,6223531588125725186,5066073236665195987,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,5474524091175943823,5391949065098938831,2097152 --field-trial-handle=2624,i,6223531588125725186,5066073236665195987,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,2531719293369609800,14475877855864479727,2097152 --field-trial-handle=2624,i,6223531588125725186,5066073236665195987,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,15680894861393681138,17928121107983568448,2097152 --field-trial-handle=2624,i,6223531588125725186,5066073236665195987,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:9
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3772,i,14054863897745154353,1494406144536061129,2097152 --field-trial-handle=2624,i,6223531588125725186,5066073236665195987,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,9427895289327978808,16044355982982862972,524288 --field-trial-handle=2624,i,6223531588125725186,5066073236665195987,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5588,i,10133503469015573108,7442371399981528294,2097152 --field-trial-handle=2624,i,6223531588125725186,5066073236665195987,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,10298455039539412428,3036281474607458170,524288 --field-trial-handle=2624,i,6223531588125725186,5066073236665195987,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,5706683178198634287,17753950929743850981,524288 --field-trial-handle=2624,i,6223531588125725186,5066073236665195987,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,9074095590393947781,11528918702463712691,524288 --field-trial-handle=2624,i,6223531588125725186,5066073236665195987,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,6873305180687716108,10416649323816785462,524288 --field-trial-handle=2624,i,6223531588125725186,5066073236665195987,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,6873305180687716108,10416649323816785462,524288 --field-trial-handle=2624,i,6223531588125725186,5066073236665195987,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,7299071847323444763,17732097540636461472,524288 --field-trial-handle=2624,i,6223531588125725186,5066073236665195987,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:14
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,12165472776902540193,3556011664162952265,524288 --field-trial-handle=2624,i,6223531588125725186,5066073236665195987,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4672,i,15382145302643813089,4751302859577590878,524288 --field-trial-handle=2624,i,6223531588125725186,5066073236665195987,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:14
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2080,i,1010856437404929597,13135941222546907055,524288 --field-trial-handle=2624,i,6223531588125725186,5066073236665195987,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:14
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6020,i,18245886220298147775,6848921465563990189,262144 --field-trial-handle=2624,i,6223531588125725186,5066073236665195987,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 da405056113395e5b08609806de98634856265b1e2cb1d53db8790a7f03219e0
MD5 b2be5865c2936865c032e2bf5c87d7e3
SHA1 8958f15afc94108d4853f3d653f434fbe39155ea
SHA512 933056b27470ce7717c56ba4758b3d7779bbb092a8af6f82e3b1972a4ccefb133d0983a242b87d045da853f814d4d08c476bcdb0143f2f09de4d20518ab12491
TLSH
T1B25140D3132259CFD3E159B121F16468B2FEA87C81076E88416B2D75CA01F8B50E347B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595b65.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595b65.TMP
Size 2KB
SHA256 3328b4dcd432ccc9732c2a1928bb9e4b61ed4c80430f9eb16731d5e16b140a3b
MD5 cb360dfc86afb57ce8b9ca01977ac71a
SHA1 7abdea3cbe5942a70090916afb51637ca9c8683a
SHA512 c2ec34c014ddb832fdcc0f2b51dfcef3cfc7ef17e616d59e4daa29d64a713990783267ac8d026febb940b154ed164cb9e424947bdce7060283283eb73a4dfefa
TLSH
T1DA5151D3132259CFD3E159B121F06468B2FEA87C81076E88417B2D75CA01F8A60E347B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

886626aa-f521-412a-ab75-762b819c8e6f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\886626aa-f521-412a-ab75-762b819c8e6f.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c3636385a027df631b7d9265336274f67caf8f891458463501179fa841a6369b
MD5 b1290076fe3d7ff08d333822c4bf2bf9
SHA1 f63678bcbf62d3ce3b633aa12f886e0ca7abedbd
SHA512 6938f35ce2ac88fee9cd10b154079d66a34117fff092efe0dde7a804897d1626ce7de48bb917d7bce3186579f7fd5cf9bdff35a16697210d3f229a5874a3459d
TLSH
T1FD519BF3C3E8856D8E1566F0AA147E1F8F1D0924832C385989E4BF1BA7E3471E245A4E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9b8b2ba35df63cfde6808089e04954b92f7e3cc3f0eb4506b978c97f755510cf
MD5 1a4a6e82f8dea35239c0269bea55ce88
SHA1 3153096222f334006aa32aede653fd212b013438
SHA512 d6df74398ff0e600682b761ae72a0f9faa88ffc407c02408a2fbe07b87dbfa1fd1f0add1182c3107e87755bb84645db391228c6eeb160d6eef0585f88da384b5
SSDEEP 192:sxRBRcOd/fTscF7Dde5lS8zoD8p4cS/g6+WNIYCN+uOrGBIgIJ:sxRBFd/fTscZc5lJdS/5IGUs
TLSH
T1B932D8165A28A93B9CC7E20DBB167F53D2F96032A1D51E48EBFC861C15E7ADD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 568b0e1a61644fecb0215fb214006c69dd1bdf76113b8f0b076ca4ee8922ffc5
MD5 13727bd067de9616fc2ec3a29e49d3ac
SHA1 ead7258d014b65744415f014382c61b2a77ec68e
SHA512 8ab28b70f243310f84cecc6350043e236a8abf2f4091b19de70916a72228a4f61f2aec66495c3aff16fa9dcbc4ba4c03882563c0822907e3f639cba847532f7e
SSDEEP 192:sxRqRcOd/fTsxx7Dde5lS8zoD8p4cS/g6+WNIYC26uOrGBIgDQJ:sxRqFd/fTsxlc5lJdS/5IbUQ
TLSH
T13B42D9155A28A93B9CC7F20CBB56BF53D3F9603261951E48ABFC871C15E7ADD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 59a97b335912447365800254563b8984deb0053f131b2295ec989c58a3dd5b70
MD5 49ac8f9400211de87815bb60bf65fff1
SHA1 56f092b47e6af3be4529931add52f02705ca5b17
SHA512 becf44d795513f387eb4789f5c63d0aa8eceaa84c92788b4db0fb7b5a9fa0a875347e59c629b717ff788b0025e24a765a3de548059bc0516cfae5e91b6ae102f
SSDEEP 192:sxRqRcOd/fTsxF7Dde5lS8zoD8p4cS/g6+WNIYCN+uOrGBIgDqJ:sxRqFd/fTsxZc5lJdS/5IGUi
TLSH
T13332D9155A28A93B9CC7E20DBB567F53D3F9603261D51E48EBFC861C05E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

eac06d3a-a8f4-4b71-916f-00b32be9689c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eac06d3a-a8f4-4b71-916f-00b32be9689c.tmp
Size 23KB
SHA256 fd05fcc91cecd049e0843df0bf81151075f347d76c35e6e07f1a30d29c0bc175
MD5 47a08b2f08e59a7985250c3a96117218
SHA1 9037cbcffb5d817598d8709fa278e9e0f7eb2598
SHA512 131e4c5ed56e2b7b0efd0b5c30ba90065beffbd84cd82f572fe1ef5f97207f8aacb5c3522ab94b80c5d55a8daebc9de63b322e369d0974b2cfe9d6879f8caed7
SSDEEP 384:jjm+vhKfCtgQCFf4+KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVmC9qyRvzroZSt:jC+vhQWgQ+f4+8F1+UoAYDCx9Tuqh0Vu
TLSH
T1E8B2EA2B600DCB7F5F800AADAC197FD76DA802CB97589D4047FED94C02C77EA92194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 18KB
SHA256 d675bad1a758b07f1ed431a7812bf9fd82a0134557a9f1479faf96798a2a9d7c
MD5 f18b79a3435844f3cd10f1b52c52502d
SHA1 686226dff62991217fcaf2118b30364ed5b08220
SHA512 203b436d074f1f469ce6afb478f21e5847cb9adeecc4318aacd5ca131357810be9a8992d7737bd36a754ccc8f35273e30b64a8a51eacd17024779ac32e0ed767
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uP:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbA4
TLSH
T15482751CC52C7E3247C92F7D6A2F9D727ACA30CA7081459D798CC69DC31B06DA58A2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 291872ff47b029574bd209e403128def50038148086c0b6f04ba6d269cc61453
MD5 aedaf275bb9abfe6e7b5f27caef2fe49
SHA1 2647a92a72b190724228aeb0cab09052e2149e3d
SHA512 61f5fdf2a02364366bcbdd4befd65948b1e9ed23530ef5689067e878601b1f660c8e13d575bb5bd149c4377797a496cff9281d35204f7fbcdd35acae7fe8ab81
SSDEEP 768:tp368Af+q9p8+p3bd66j+4BRv86aLIW/f5T7:tp3A78+p3Z6n4yZf5T7
TLSH
T1B3F2BE72E8A8DC335CF5D284B24636436FB4506396C45ED4E8DDBB1E119B1AE270B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b68283c7290eaa7ad771e37f83c23f68b539b6b5ed5c80f7432488a977294a1b
MD5 bc4513f97795cf83a50e71dca0ca17ed
SHA1 c8910612285b3889c7f20e253ea107d5bc3983c4
SHA512 ea2065d92831add190c954bbe2bedf53a0d47c9bd3db2663d0114b5046d31062cc753a0e30ed9c07bde3287f3e984361524bf5d017cbec6b2b790cbd72e70752
SSDEEP 768:xrv+4UNbdi3TRAf+qcp8+p3bd66j+4BRv86aLIW/WV:xbsbA3E68+p3Z6n4yZWV
TLSH
T10F03AE32E8A8D9339CF2D644B24776437FB8515386C10ED4E9DD7B5E529B0AE230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 77a10eca041075632f5370fb6a5b85c98a4ed532c63275442b63cc566fe3362e
MD5 1931c9d42765e75655dd57888d6247c7
SHA1 361852e61d996fa8e21d624f8a4f701ef4abd385
SHA512 6399263d82c08c1837efb186459fb6cee50f8405b3c7873275aac7a39143230feab19422465d4bd92f8bb974138e243f0bd3da759ee92102389cc9c38165da79
SSDEEP 768:np3T8Af+q9p8+p3bd66j+4BRv86aLIW/f5T7:np3X78+p3Z6n4yZf5T7
TLSH
T1E8F2AD72E8A8DC335CF5C284B24676436FB4506396C45ED4E8DDBB1E119B1AE270B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 dc2aa4103cb1ea76d978cc14d2de20b3a301a03c256273246d18fa8ab1376ff0
MD5 97cc9dffd0d71f08b66e7f1f2d1ba42f
SHA1 08c7acc2670047e1eefe2e9c0455e27161de784c
SHA512 3340f5df9e945420bf5ba37c3af7c66397629c6a4ce8845ab39286de67f51c72387d5795fa37e4ffdbca43201066970202ac1db130be985e27b10e8b7b314041
SSDEEP 768:kFQz3rwge8Af+Pp8+p3bd66j+4BRv86aLIW/f5T7:Hz3B8+p3Z6n4yZf5T7
TLSH
T10DF29D72D898C977ACF5DB84F6463203AFF450A386C49E90E9CDAB1D11971AE130BC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8be4bc151c4ced77d9bc31d4c6506745cafefaa13907f45c0bb0a8c5d2daa51d
MD5 aec4e405953b4f18610436ea7818a0d2
SHA1 c440192686778da0c7a3f7abc047c239a67cd950
SHA512 5780916f2c89d44ad97bfa774bbf9f7e89dda7c7fa04d16ed98a729ee587d68f5d3e169767e63672f913a572fc4066a4f5e3e9b90195e0bab370fe74917c5c8e
SSDEEP 768:Irv+4UNbdD3LcfKNp8+p3bd66j+4BRv86aLIio2bwCl1:Ibsbp3HL8+p3Z6n4y60ww
TLSH
T14203CE33E8A899739CF6C648B24677437FF851A396C10EC4E4DD2B4E416A19E230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 90456f92ccf64a36e5290126265af3166a4c8b447bb548e47a89c5bc98fc986b
MD5 da037ab2d303aebf41172a82833a5737
SHA1 f48b0c76c789704a7ecceeea518c02a784b6ae51
SHA512 a34f7c7ebc9cae54b75a2119b5fe0a8149496467f6bee8662991894bcec4426079a1f3953d22222db1850a5fc46c23d21684b734d88751d27398e7ccff80e5c6
SSDEEP 768:Hrv+4UNbdD3Sef+qNp8+p3bd66j+4BRv86aLIT/2bwCl1:Hbsbp3jL8+p3Z6n4ye0ww
TLSH
T1AC03BE72E4A8A9339CF6C644B24677437FB851A396C10ED0E8DD3B4E519A19E630F837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a5e04ade-b97a-4cb9-b55f-a18ac6279842.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a5e04ade-b97a-4cb9-b55f-a18ac6279842.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

te_W2026082051284.zip.crdownload

Path C:\Users\Admin\Downloads\te_W2026082051284.zip.crdownload
Size 5.1MB
SHA256 fea5577443c8378b53bf5665c911b910daa32e11ba2003082a977255bba7704c
MD5 2778cb573fb5b9f85ea2c982d31883f4
SHA1 a4e1ea235ba6f89b4bc04273242eabf8195160a7
SHA512 08280bf1eadd76796a9a6ad5134c4a82d22c803068f0cb3a4095db1abf70a7b3623216f437d3927f77602aab483b331a911398073c37d9caa5b87712e56a2d97
SSDEEP 98304:Serb7vGGj5itpEps+xbg8WVkwLPhFzDlKNtNBFPVwAsTXGzykRdr:SLGFGks+xb8hLnnIrZVwANzP7r
TLSH
T1363633E1E29D093946F505281B16044CE7C3A21EA74D4C7E1AC32EEAD8F7ABD4CD1F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download