hxxps://94wug[.]r[.]sp1-brevo[.]net/mk/cl/f/sh/1t6Af4OiGsHn13gegyOHBh2Ts4BDq1/tlcB2M8iuaB1

Analysis

user interaction
yes
max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://94wug.r.sp1-brevo.net/mk/cl/f/sh/1t6Af4OiGsHn13gegyOHBh2Ts4BDq1/tlcB2M8iuaB1
Sample260827-e157vsxwgw

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3440	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322783326976790"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{50A9403E-2840-4615-876A-9FACBDF3BA7D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3540	msedge.exe
3540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 4008	4704	msedge.exe	87
PID 4704 wrote to memory of 3440	4704	msedge.exe	88
PID 4704 wrote to memory of 3252	4704	msedge.exe	89
PID 4704 wrote to memory of 3252	4704	msedge.exe	89
PID 4704 wrote to memory of 4508	4704	msedge.exe	90
PID 4704 wrote to memory of 4508	4704	msedge.exe	90
PID 4704 wrote to memory of 4508	4704	msedge.exe	90
PID 4704 wrote to memory of 2792	4704	msedge.exe	91
PID 4704 wrote to memory of 2772	4704	msedge.exe	92
PID 4704 wrote to memory of 2792	4704	msedge.exe	91
PID 4704 wrote to memory of 2792	4704	msedge.exe	91
PID 4704 wrote to memory of 2772	4704	msedge.exe	92
PID 4704 wrote to memory of 2772	4704	msedge.exe	92
PID 4704 wrote to memory of 4772	4704	msedge.exe	94
PID 4704 wrote to memory of 3952	4704	msedge.exe	95
PID 4704 wrote to memory of 4772	4704	msedge.exe	94
PID 4704 wrote to memory of 4772	4704	msedge.exe	94
PID 4704 wrote to memory of 3952	4704	msedge.exe	95
PID 4704 wrote to memory of 3952	4704	msedge.exe	95
PID 4704 wrote to memory of 5036	4704	msedge.exe	97
PID 4704 wrote to memory of 5036	4704	msedge.exe	97
PID 4704 wrote to memory of 5036	4704	msedge.exe	97
PID 4704 wrote to memory of 4176	4704	msedge.exe	99
PID 4704 wrote to memory of 4176	4704	msedge.exe	99
PID 4704 wrote to memory of 4176	4704	msedge.exe	99
PID 4704 wrote to memory of 1036	4704	msedge.exe	100
PID 4704 wrote to memory of 1052	4704	msedge.exe	101
PID 4704 wrote to memory of 1036	4704	msedge.exe	100
PID 4704 wrote to memory of 1052	4704	msedge.exe	101
PID 4704 wrote to memory of 2556	4704	msedge.exe	103
PID 4704 wrote to memory of 4480	4704	msedge.exe	112
PID 4704 wrote to memory of 3516	4704	msedge.exe	113
PID 4704 wrote to memory of 724	4704	msedge.exe	114
PID 4704 wrote to memory of 2464	4704	msedge.exe	115
PID 4704 wrote to memory of 2464	4704	msedge.exe	115
PID 4704 wrote to memory of 4908	4704	msedge.exe	116
PID 4704 wrote to memory of 4908	4704	msedge.exe	116
PID 4704 wrote to memory of 464	4704	msedge.exe	117
PID 4704 wrote to memory of 464	4704	msedge.exe	117
PID 4704 wrote to memory of 3540	4704	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://94wug.r.sp1-brevo.net/mk/cl/f/sh/1t6Af4OiGsHn13gegyOHBh2Ts4BDq1/tlcB2M8iuaB1
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ffbe35fc188,0x7ffbe35fc194,0x7ffbe35fc1a0
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,15292585545610315049,4547417034981542361,524288 --field-trial-handle=2356,i,9803728226191354140,6409945731900498166,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,686906487091507597,10132743521460123114,524288 --field-trial-handle=2356,i,9803728226191354140,6409945731900498166,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,14268599120134928189,17617075072087013417,262144 --field-trial-handle=2356,i,9803728226191354140,6409945731900498166,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,12009661851124493550,10258075056109944093,2097152 --field-trial-handle=2356,i,9803728226191354140,6409945731900498166,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,5608917024589947909,11411835187381911890,2097152 --field-trial-handle=2356,i,9803728226191354140,6409945731900498166,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,17148662327387483218,12782254987771950121,2097152 --field-trial-handle=2356,i,9803728226191354140,6409945731900498166,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,260478214901987257,7159011920416948048,2097152 --field-trial-handle=2356,i,9803728226191354140,6409945731900498166,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5104,i,12492520300428553142,21798974376862971,2097152 --field-trial-handle=2356,i,9803728226191354140,6409945731900498166,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5276,i,3196434261970823470,12787749748386963733,2097152 --field-trial-handle=2356,i,9803728226191354140,6409945731900498166,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,9916242230727367344,10206760578866384435,524288 --field-trial-handle=2356,i,9803728226191354140,6409945731900498166,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,13251156062219432976,6964540242550320282,524288 --field-trial-handle=2356,i,9803728226191354140,6409945731900498166,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,11689019310543336478,7987384239315367417,524288 --field-trial-handle=2356,i,9803728226191354140,6409945731900498166,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,11689019310543336478,7987384239315367417,524288 --field-trial-handle=2356,i,9803728226191354140,6409945731900498166,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,1949556745447239427,3453381778651747181,524288 --field-trial-handle=2356,i,9803728226191354140,6409945731900498166,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,16017145962449230563,11512638963178366317,524288 --field-trial-handle=2356,i,9803728226191354140,6409945731900498166,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,1751211419594548022,14277604395047499809,524288 --field-trial-handle=2356,i,9803728226191354140,6409945731900498166,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,16175678407946805330,11626472937518935248,524288 --field-trial-handle=2356,i,9803728226191354140,6409945731900498166,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,616841340310805576,15023571571464497704,524288 --field-trial-handle=2356,i,9803728226191354140,6409945731900498166,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,3351765335856839187,11802436005491245584,524288 --field-trial-handle=2356,i,9803728226191354140,6409945731900498166,262144 --variations-seed-version --mojo-platform-channel-handle=764 /prefetch:8
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6184,i,18402133058721173512,3476108723697148634,262144 --field-trial-handle=2356,i,9803728226191354140,6409945731900498166,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bd5dff6b6a2953b678276fe774acb1020dcf956eee918258c4fbcebd9799de50
MD5 ad9e9cc59d40b3c4a865c23e526c194b
SHA1 ec6e5c23153f46461256dc2ee3316df628e2eda9
SHA512 781d6d2d74c84caa1d22367f03cb2eef3a2125624c47277182248dc2b092992ad8756b1ea9759b2d56ee2b90c008cd691688382416e421209d33f546892f8550
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 29f04015f13b0aed674b9ed53a484c06c83d399e4a1aff484302d2114c936587
MD5 34859f6efc3af84b3b78ee97fa178f69
SHA1 1351e689e461356e4745f7ae772f40bd1eeca8e0
SHA512 edf905c823aa1be17fa3ab095894a722b1dc3db9c0c0c77667945fc4941ec2a472346b19af8188909a0c1ac7f2ccf7b77a8ef89607d4cd4f8e0989abd8c0a48b
TLSH
T134E0D86A4BD5F1F619019447B46CE22845106207E788CAD63309E0CE27B3A9899A30A4
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 be2e2ad3d2d4437b412cb16a303d64dd4b6ab3083900a9d243427ec596d8eeed
MD5 6fff17dea4e1c6b71e66ba8e014949ae
SHA1 5669febf3b564d1634cc4fed80d3849e9a798721
SHA512 d2b57ebe94d2ef2a4bd23c9b1adef5c6184412a8242e7444f0172ef34217d44e28b52f0ce6c21321bdf41936e2dd277bccd55e1e7570e44b515371fe0f8ab52f
TLSH
T10BC08098B98C845DC285187EA726F00007606561941796135560BCC03140DB01E2E120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3828e58e33ab9b425035dd06f6fb8cf809ddc524bf8824e7b954105e57a88506
MD5 daa33f15b514b0847d7574da3ef8b103
SHA1 bb57049f1266d625244f9ce2d8f469a5809c4ac8
SHA512 3924dbae03e180c98f5e01032af74bbe8eb7f24b57277124b66fcf2858b144fe0506fa6276cbd9de78d8611c65ddfda4e9b2d043be3ae4e1a0a1c7c1942fbcbb
TLSH
T12971D79681B5CC86FBA67531E2E1B99034FC48A43A5F3F8E184059BFFA0E7647021E34
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bcd3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bcd3.TMP
Size 3KB
SHA256 1999e5b52fe0bac1f6016e57f7ec58c748730dd1671ecf06a3a3296574343ea4
MD5 4833a2002ae90332d2b86075efb5120e
SHA1 b689dba86d1e03e0b82c3d8db712253273fb65c5
SHA512 3bbf6d7fa28475e95f28bbb30754803cb1d9a9a63941d88f9f09c15844e5d18174e7a51b9df3546340d1a358291fc0a72b46a7c0bbb795eb15a3b0aa7f458344
TLSH
T11A61C56886B1C985F7967431F2E1B20434FD88993A5F3F4E585059BFFA0EB147025E38
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 5fa15338316e6a6924e512263231325abdcce70af5bd4d1cf090b43521a8550d
MD5 586cba157fbe404268bfcb072387599f
SHA1 753dc15cfbde1930043508a1e131d0514dcde9c3
SHA512 4bcdf20eb57fcb4b6831960c67945bd20cfa98076d5cbb7eac6a933c259da81051896a4a3b2426e4ae2c53df535c2aaafc3aed8f05c9327e21c3d8ab7cf75f2b
SSDEEP 96:DNOPjetgJYq6zBP3anr4/jtBi7CRrq1OQTbZ/jvKwQ:DgPjetgJYq61/anrWjroCRriOQnlLKT
TLSH
T1A5A1CBFBE6E4616DDC1652F06AA46E2BDE1D0416032C3D16C5E8EE0BA3F30B0D10998F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 393cabba45529ffb092eea8d2a23b9fad2502b46be1d07b42a271bd5f2ff528e
MD5 572202fd56cb8aaf3e1675b2ca5b5078
SHA1 691c25d60ed2b49a96bd45bb3cc3c856d78e9409
SHA512 1e92ad35c33ee7f35202b6b2ddf6e9188164782ac4e58c493c3a3631f3a7ff89bd84d9a8f4df4bad4fb8c7dff1773227a5ee2de24aabbfc8e79f58564eb28651
SSDEEP 192:sxZnRJiyM/jK1Ml8MkP/fVsFa4IdpmBrHW6+WNaBcy/Y4Aty+cIgrJ:sxZnOMP/fVsFaJgHbi/DP9
TLSH
T1E952E811AA74A977CCDBD20DF955BF63D6F5146292900E44AAFCCA1C05E6BEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 38d308f9420ec59711cf2f15cd24b2a3af7225ee72b469e468092245098009a5
MD5 cbceb6573b5240827122aa8059d3b0a6
SHA1 787be076228756ac8a4c23ec22b53dcae3fd0b06
SHA512 97c15aefc26d2ff3e92bd2d304341ddb17e6253a822762304420db399f6ab1296d3d33dd0e2ac5c2765bf16b6dbcd2609a13f28c13c3ee13f5de48bd5fcde454
SSDEEP 192:sxZnRJiyM/jK1Ml8UQIkP/fVs3b4IdpcBrHW6+WNaBcy/Y4nSy+cIg5dJ:sxZnOqrP/fVs3bJ2Hbi/FPR
TLSH
T18D52D712AA74A977CCD7D20DF955BF63D6F5147292900E44AAFCCA1C01E6BDD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d81bcf3066abe96745ed5ac6051de3f690d92bef75e6452940078aee8842d977
MD5 a54d1c1654552134e829a76813bf356b
SHA1 05127b3a1b18ba97f65e8bde2684fed8d87e6c62
SHA512 b6d0aa811baa5e138dd1d1c3097997f61b4012dd24ae0f6577b82870c46e57d2be8d3afaf704686923e6a0de7f97e5bd78de71f9be3898b4eed81497688bacf6
SSDEEP 768:M68iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdXrowkIUny:M68iJPNWvx76ru1jahALocdE0Uy
TLSH
T1E8D2FA3B680CCB7E4F844E9CEC266F966DD801CB5B948D5447FA884C03CB6EE512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cd627efe9563e3e0a495575c19da27a8ef8c92216ef6cd79b27760ebb8ff5a98
MD5 10ca62e9198d9d02b86d51c24059bf54
SHA1 ded09c2260d66255ceba1751e3180e9a8bcc9062
SHA512 29a9fc84896a597837461f34dba93f92d20872de828c61fe66d92c9a90a553db28b33a43540c686e03f554e11fd16563734bd17765c8d6eb868b86fef8d6996c
SSDEEP 24:Kd56f5t525na58d5Q5s5o45Y5E+57Ij5S5oKi5rha5E5o1E5y54Sm5GM5v85a5lB:KYBIJKCEkTypEIbKxqU1DINKQUYHyZ7
TLSH
T13B91640134FB16513DFF660C93D0966B174271637618A53B3BE805B20E6AE682CFE9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fae82292-7ebb-4a09-b88d-2fccfc261392.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\fae82292-7ebb-4a09-b88d-2fccfc261392.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 827a87366aeff9349162a61b7ef662045e3e567baaaf2ac68ed5a445aba461a6
MD5 78c14472333629f21bebac03ba91405b
SHA1 2c08f3f8cdd60a567f3fd0cdc6e6580aac435f35
SHA512 4e2b9c44cf0e0aa7e6d5e27b3359cbc867242a283c3b6647ceac1268f858aa43d8df82b085ccf5c010a127f9ac2472fee607bfb6181dd86d90f94a313c071ac5
SSDEEP 384:8ZcIhsNYUI/5HooT3ukqdhdi1+HBbs9Fzoj:qhZ/tYdi1gqFc
TLSH
T113827D7158A8ACBB5DF2A109F98736135FB8846BE7C86F90D4D8A71C05DA5A8130F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9a750908921cf2ed0aae83e1daf7ce4a740b99f577ffd1cc35d361d73eb8628d
MD5 d5bce31c8882ba654575a375d9af7970
SHA1 0902e8299af416243f51ee87ef828c7c5cb000bc
SHA512 3d0a5669df504b71a8a7d50a695cb558a7d342e3d46954a6930178a3f918da7c1fd1f4db63d395afb20940797f0004a86980330e54f8b49d20109804a567313d
SSDEEP 96:ZqONk6QsjpfmUTmDK5ih/cIPURHl8h4otop5u5DIBhPwivh50xy0SFYKIAxteYkM:gONO6kDfQmiUyY8Z903vZQi1qU6
TLSH
T19902F938A8786C7B8EA3AE49F58637275FA5213BEAD42FC0D9E41B1C01D764C1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f7c81209946c65e5d2edc73fc10b462c5e7cc4db64a4a323fefd711d1018c22d
MD5 d36f0e38819449ef531fecf4002655fc
SHA1 25011546b130d64c091202866d4f3b4c9dcc9bf0
SHA512 0ea0fcbfd195e58d8465b0d4e5752e97ec091dc1911331a01c0b69a3ee5b873ac07a495a946ebcbeea767728305eaed2b632917253174f9f34a03de24458944d
SSDEEP 384:FiFiZcIIsNZ8TUNTUlIlX/5Hoo63ukqdhdv1+HBbs9Fzoj:MFQIAwgZ/MYdv1gqFc
TLSH
T1BDC208F248D7987AD9AE9747B77E2D134EBCC067B6849A50B3C4561CCD960BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a1eac0152fdd7769e68b2ab5a988ebfbd25b96de2830fc0ca9db551e5920a106
MD5 0eb172d509c6593a8cc49a6b7f24775d
SHA1 dc19ef22e1954b48f94f5e3366327173deca5eac
SHA512 1759a9d2940514f33cbeb75328947e6def0a05ec7a158a6d7ae3c2a9090f9b14d43eb42f056d729c7714b7f9e99192d52d9dd7d532b3c8d84c0d929d5b808f8f
SSDEEP 384:LZcIhsNYUX/5HooT3ukqdhdi1+HBbs9Fzoj:ThM/tYdi1gqFc
TLSH
T16D828D7158E8ACBB5DF2E109F98736135FB8846BE3C86F90D4D8A71D05DA5A8130F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 373a95286f9569c421ab0659807b961f4b79a046a58b3dc18685f6b348eae05e
MD5 33b76c87dc35fd5353e87df2ab1543e8
SHA1 83e695bb6afa5c739b7eea8493b0bb0da274beb1
SHA512 d6af3c0bb6fba9108ea147ec521d251d4f63938cdb78b93a70083af822ea53f1cc4ee726d94fd3e7d1037b2984d5266d1ca129e2236d2ee938991e9f8d3f990c
SSDEEP 96:zqONkOQsjpfmUTHK5ih/cIPURHl8h4otop5u+DIBIPwivh50xy0SFYKIAxteYkMm:WONa6kSQmiUy/86903vdhd6cRdqIU6
TLSH
T11E122931A8A8BC7B4EE3A859F48736135F65912BEBC96FD0D5DC2A1C02DB59C130B813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 73977f5a1ce32e1dd593531b71c168a5b42105494d2d52ec9b17445cb0d22e5a
MD5 010806c3c8307da3aa53309586707c56
SHA1 f3dbd5ba50dd67e20c8490550661c5e392a2d29c
SHA512 0459ad38fcbdf3693450adbb2af972784a89f434154705e398029c1a3213dd0bd76aeb88f24231819a193b4ceac6622a193d8a4af72c77f460a3c4e8c42c11e2
TLSH
T1E9411848BAE91148B3B67F469BF6A86D487EBC372F07D46D10110E4E4A23B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download