hxxps://web[.]plaud[.]ai/s/%20pub_d89545ed-f843-4ff9-800e-d082a55a1eb3[::]%20AUjC-pulYhEVljgWeKliyzHTp_DMndWYTOA71rvBoq_svE12gJYngeiObE9DsTktOhjlPhNHSjCp5LMC

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 15:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://web.plaud.ai/s/%20pub_d89545ed-f843-4ff9-800e-d082a55a1eb3::%20AUjC-pulYhEVljgWeKliyzHTp_DMndWYTOA71rvBoq_svE12gJYngeiObE9DsTktOhjlPhNHSjCp5LMC
Sample260831-tb5mcsvfrb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
332	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326652495332587"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{7B8E57D8-D8C4-4330-9E1C-9DAE90E72642}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3160	msedge.exe
3160	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 1732	3796	msedge.exe	84
PID 3796 wrote to memory of 332	3796	msedge.exe	85
PID 3796 wrote to memory of 1056	3796	msedge.exe	86
PID 3796 wrote to memory of 756	3796	msedge.exe	87
PID 3796 wrote to memory of 1056	3796	msedge.exe	86
PID 3796 wrote to memory of 1056	3796	msedge.exe	86
PID 3796 wrote to memory of 756	3796	msedge.exe	87
PID 3796 wrote to memory of 2880	3796	msedge.exe	88
PID 3796 wrote to memory of 2880	3796	msedge.exe	88
PID 3796 wrote to memory of 2880	3796	msedge.exe	88
PID 3796 wrote to memory of 2316	3796	msedge.exe	89
PID 3796 wrote to memory of 2316	3796	msedge.exe	89
PID 3796 wrote to memory of 2316	3796	msedge.exe	89
PID 3796 wrote to memory of 1672	3796	msedge.exe	91
PID 3796 wrote to memory of 2744	3796	msedge.exe	92
PID 3796 wrote to memory of 1672	3796	msedge.exe	91
PID 3796 wrote to memory of 1672	3796	msedge.exe	91
PID 3796 wrote to memory of 2744	3796	msedge.exe	92
PID 3796 wrote to memory of 2744	3796	msedge.exe	92
PID 3796 wrote to memory of 884	3796	msedge.exe	96
PID 3796 wrote to memory of 3268	3796	msedge.exe	97
PID 3796 wrote to memory of 884	3796	msedge.exe	96
PID 3796 wrote to memory of 3268	3796	msedge.exe	97
PID 3796 wrote to memory of 3608	3796	msedge.exe	99
PID 3796 wrote to memory of 4272	3796	msedge.exe	100
PID 3796 wrote to memory of 4272	3796	msedge.exe	100
PID 3796 wrote to memory of 4272	3796	msedge.exe	100
PID 3796 wrote to memory of 4180	3796	msedge.exe	101
PID 3796 wrote to memory of 4180	3796	msedge.exe	101
PID 3796 wrote to memory of 4180	3796	msedge.exe	101
PID 3796 wrote to memory of 4348	3796	msedge.exe	102
PID 3796 wrote to memory of 4348	3796	msedge.exe	102
PID 3796 wrote to memory of 4348	3796	msedge.exe	102
PID 3796 wrote to memory of 4628	3796	msedge.exe	112
PID 3796 wrote to memory of 3820	3796	msedge.exe	113
PID 3796 wrote to memory of 1596	3796	msedge.exe	114
PID 3796 wrote to memory of 1836	3796	msedge.exe	116
PID 3796 wrote to memory of 1836	3796	msedge.exe	116
PID 3796 wrote to memory of 3160	3796	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://web.plaud.ai/s/%20pub_d89545ed-f843-4ff9-800e-d082a55a1eb3::%20AUjC-pulYhEVljgWeKliyzHTp_DMndWYTOA71rvBoq_svE12gJYngeiObE9DsTktOhjlPhNHSjCp5LMC
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc8e4dc188,0x7ffc8e4dc194,0x7ffc8e4dc1a0
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,12756868900422785689,13315646072700072759,524288 --field-trial-handle=2540,i,11184951268851430287,9156218404861792740,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:3
  2⤵
  - System Time Discovery
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,3564975568706201879,8104750231892900818,262144 --field-trial-handle=2540,i,11184951268851430287,9156218404861792740,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:2
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,14177003685081845411,2840001440642072539,524288 --field-trial-handle=2540,i,11184951268851430287,9156218404861792740,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,14932151606381620821,17828940946282594474,2097152 --field-trial-handle=2540,i,11184951268851430287,9156218404861792740,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,6449532613882184379,9474402500221548694,2097152 --field-trial-handle=2540,i,11184951268851430287,9156218404861792740,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,9116468322617088423,17537932003944499605,2097152 --field-trial-handle=2540,i,11184951268851430287,9156218404861792740,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,1306445866963541670,17811354142598220327,2097152 --field-trial-handle=2540,i,11184951268851430287,9156218404861792740,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:2
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,712116192609079450,9948788347954980499,524288 --field-trial-handle=2540,i,11184951268851430287,9156218404861792740,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,2328655134699860259,12216346030377529750,524288 --field-trial-handle=2540,i,11184951268851430287,9156218404861792740,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,14363175950287378017,16284253955945801771,524288 --field-trial-handle=2540,i,11184951268851430287,9156218404861792740,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,14363175950287378017,16284253955945801771,524288 --field-trial-handle=2540,i,11184951268851430287,9156218404861792740,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6208,i,3442301614151064710,3573671849349621872,2097152 --field-trial-handle=2540,i,11184951268851430287,9156218404861792740,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6408,i,13843626109940698071,5337993796273251095,2097152 --field-trial-handle=2540,i,11184951268851430287,9156218404861792740,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6544,i,5142559806414887044,15369983469368673998,2097152 --field-trial-handle=2540,i,11184951268851430287,9156218404861792740,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,15281618455963329385,8863822750928831910,524288 --field-trial-handle=2540,i,11184951268851430287,9156218404861792740,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,13147345021827867718,13694989364107384260,524288 --field-trial-handle=2540,i,11184951268851430287,9156218404861792740,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,1857272515611543891,776433761159806703,524288 --field-trial-handle=2540,i,11184951268851430287,9156218404861792740,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,3305052173854183392,945672493540962979,524288 --field-trial-handle=2540,i,11184951268851430287,9156218404861792740,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6132,i,5717745365173751639,6013468149204823777,262144 --field-trial-handle=2540,i,11184951268851430287,9156218404861792740,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3160

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bd5dff6b6a2953b678276fe774acb1020dcf956eee918258c4fbcebd9799de50
MD5 ad9e9cc59d40b3c4a865c23e526c194b
SHA1 ec6e5c23153f46461256dc2ee3316df628e2eda9
SHA512 781d6d2d74c84caa1d22367f03cb2eef3a2125624c47277182248dc2b092992ad8756b1ea9759b2d56ee2b90c008cd691688382416e421209d33f546892f8550
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 51d62524794aa21dd4307cb0f06e965479158fac4e9652dc564663a7bd060052
MD5 881e8413bb670bee6b09ec406163cc5f
SHA1 08ad2fd7b0a97dfb9068069bc280c871892e408b
SHA512 3246af32c0ff18b96f3e740540a8b0ba0976a01307e79ab3b89acf645aef083d9eb68a185e6d91c9cc08187266fd54a67e8906cd2ce21c9cc114d53c710eb1ef
SSDEEP 96:X7CUoMTh9vBxlbVisre5OCosdWORMfKTsGG0ibGt:X7FoMV9vBxlEl50sdWORGKW0ibGt
TLSH
T158D1708F09AC54BBFBD42A3497C20BC13A70F056598F4E030D029E76D716789F839EA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5884bb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5884bb.TMP
Size 3KB
SHA256 6f0ba5e2078f6beb4fdc885ea8fafb9f00913c901595c76f76b01e0028d4c97e
MD5 7e6dcb0ffaa9b75af48c0b7f08ab41ee
SHA1 ec279a5a52f7c8c86da5fc98e9046ed802920aee
SHA512 b6d523b69183023a8904bad802b4a8dd6b2081b076d8d8d8726e518be131dcb91218894ba753be1361c3179e4d10c77a1637eb337efd2864ca80d5e20a70b921
TLSH
T1CD611A0A0D8E1984F3A93138A3D243C239B1C4AB19DF9E070157D6BBE91671D4C26DFB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 003acfbfcd1ce84d93cc7e2785b990fc13d4d6db4426b97de9b94b7679f0ed01
MD5 0a9b753e6466c60cf6abb584a43e1681
SHA1 b3056e6547dd718ba1d5eada1ee1fb99748c81c4
SHA512 933a8d33f24365bd41c47eb56787a2ed1ffd3264b8389ee1652ea010d69afac33b4ab397fb01ac71f4e5daa9075b24d5fd12c66c1e68c429c34e94b5bb6831c5
SSDEEP 192:DB9fS9K9P9U9R9A9N9U9L909i19Aa9f9Y919Vk9d9AVZg9X9L9g9y9O9M9l9w97u:DBAMxS3i/mdm01GaRa/EXGVSVxmQUun1
TLSH
T1AFE1C9F7C3F8866ECD0212F0BA543D27CE6D0515422C7E6AC5E4AE8B63E6470E29194F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fd82d813aae808edcd791c39c5a5f790a659e8f24aa37c79f2fa0e3ba53c595d
MD5 4bb46303738e94145466b9110488e292
SHA1 a991c7261339223dd296455fa3deb886bb20aa71
SHA512 8d898f5574218227a74ee8c5ee258325a6047f43eafdf239d8d9a539803791ed1c4cb8e4b42dcc27ce4502adc118513baca3f9354e8ad55157d73e3b6f458349
SSDEEP 192:sxZgRlyM/jK1Ml8Mkz/fasvuA8UIdp1vHW6+WNY9U0/YHhL2FpIgrJ:sxZgPMz/fas2Am5HbYV/z9
TLSH
T15A52F8116A34A977CCCBD209FA567B53D6F54472A2900E44AAFCCA1C04E6AED3207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c16af5ac0118e1462009dd096f8841658ef190af403eac0adb41d186fec5b514
MD5 1856f96afbad92a607bde1515683719e
SHA1 ca7c55afde20cc29fe0132265031c280dfa72807
SHA512 8958a053b6f40f632bd9b2e510468fa37a51a64ca06e38df1bc8e67332d478d7cbfd38b4b1980f01f1be38c9474e488b63db7a48e4f09984fd45415c5543c8d4
SSDEEP 192:sxZgRlyM/jK1Ml8UQbkz/fasvuN8UIdpbvHW6+WNY9U0/YHtSVFpIg5JJ:sxZgPqwz/fas2NmDHbYV/hx
TLSH
T1C052E812AA345977CCDBD209F9927B53D6F54472A2900E44A9FCCA1C04F6BED320782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 53a2dca9ceb8d98fa8bb06241ce65453a880f8ce0a0f6b9a2ed46da8bdd3953c
MD5 32744705c4655845988f9c7a67f6e95b
SHA1 b8764be69e1b8e77bc867e255f30d3d536bec45a
SHA512 096ccc7fcf862b4520e8ec919098dc98f1a568954c6f9fd5bf28485743f0cea5e71148552443ebd304828bd4267e645457dc78a6d2ca078b9128ab2963ea6494
SSDEEP 768:gDUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RrroVg0x:gDUZYTMWvg0Pou1ja7eLZmRYBx
TLSH
T12AD21B2B280CCB7E4F844E5DEC266F967DD801CB5A984D5447EA884C03CB7EF512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 1ecd5a00d3f816c78596705d72eb460a8d48622fc1f958ef93d3cdcf83766baa
MD5 63326c1ce5b4b9e5c98ccc7a5dea2c36
SHA1 6ef8aa6417ccebeb1aa1c0cd2163df0eddf2ce21
SHA512 bcf12364c155dccce5f0b42545bbd5feccb5506acbfcb5d51be951ad78be267786b623536383899b008ed8fd90b5e61660638210a855226dbbed652e8871b39f
SSDEEP 48:KA1ItK2AIHIdKUMgHypa/MAac8hZ8yI/KDyQ/yNDIlKA8AE:KA1eK2AIHuKUMSeCycKDySuDeKA83
TLSH
T1C3C1294271BA46933C7F6A08829497278E42B3737118E42B7FAD50B24E67E205CFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

37973dc0-23c7-47c6-9fa0-b87a147cd811.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\37973dc0-23c7-47c6-9fa0-b87a147cd811.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 8a9b52bf8bdc19fd5eb4a5710d56937e189144f921d7cbb0a410b6273678877b
MD5 0dd503357296e3bc1a525f7eb5d75b63
SHA1 ade6da7321f044126579161a972a0b246bc79b38
SHA512 b6af610ec0f4f95390b5e67e35ee7acf66a89a942230dcb44764bb712bff986978350a44605210d23951ff211e053aacfafd8ad27e207a7e597a37e916a3ce97
SSDEEP 384:zgiFiZcIApsN98TUNTUlIlIjM/HyuzX5od+a8O1XIt0X1puLtsvoz:3FQaIwgQ0rOVItsyLtsvo
TLSH
T1FDC21AF248D7987AD5AE9747E77E2D034EBCC067B5849640B3985A1CCC991BFC30AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 345609ed7bd62af2a46d1cb0e213ce0367a681756f3d1671664d72b1cbd04c1e
MD5 4430bd6f742e818750e7b87082611303
SHA1 30438a7cc26f8f7d13cf1478fe427f947c4fe7ca
SHA512 62b17928a0c42cd522dca6cc4e8f5508ccf3c5cb7c6aad56b02d7b5f54f5d7f9e05d2225fb6b8d549f4ff28b5b27cc22de5cf4a75f18ae787d70ca030920e7fd
SSDEEP 192:yONb61VWQmiUyrugGX5Obd+jCjzorOyR5/a03MYU6:yONb6WDgGX5od+a8OTnYU6
TLSH
T17E02C735A9687C7B8AE2AE49B48737136FD4206BEA956F84D6EC1F1C00D765C2306C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ee862b2e5ba3ad3d715a3c3218bb1a7c19b963760bec25f2bb332ffbe3a7a963
MD5 d53c31c6916c7ccb014e53a474ea5a2b
SHA1 2c9215dc5e2ec82c45f2c3b9d0e42917fc9fb302
SHA512 1c1110a26b2295bdf426db4a12021767ab67e11a0551e5bf01555abfa80141807742d5d03956bc3d01e168e98f45e00ed15035a445801709fef86c4eeece3914
SSDEEP 384:cZcIhsNjZjM/tyuzX5od+a8O1Xut0X1puLtsvoz:KhYyrOVutsyLtsvo
TLSH
T1AE826C329D78AC7B55F2E545F58B32078FF89027E6D86B80D6EC6B1D00ED598130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5417158f9d813ceccbbddbd17bdcb161493e4940be93d9fe94eeab1fd568add1
MD5 edd19d44b5f490f7c102f36882663a08
SHA1 48c4c7f8fe6175a46461e8fa3a8b3e5673a9cc4a
SHA512 5691230e864487f65d5f5df564b07b7bbedd04d155b62e9ab14febd72d806975063be9fdc1b5cc1edd46c7fc76e63064b2754d4c07b8bd4519fe606cb9b0f8bc
SSDEEP 192:rONCh61eWQmiUy7FulGX5Obd+jCjzorOyRwXmjJsqTU6:rONm6bnlGX5od+a8O1XCtU6
TLSH
T13512FA32A968BC6B5DD2B954F48B32135EE55067DA856F80D6EC2F1C01DF69C230AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b70168a7bc7343b12ddfc8025ea1970f66abb2af99cb4f57c9a6962504715787
MD5 b798ccfbe3f6fcc323980bbf60a38ec8
SHA1 399f2fb6c22f87406afa230baa60e67cabc4bd32
SHA512 5ec0ddd009edd1505f37adee43361b030b60331f69fc78be6a63f8fd739542d56a1a5eb49943e2e942db9e4a3011a3af1feaa1af44c59ffd79f2862820e61638
SSDEEP 384:YZcIhsNjIjM/tyuzX5od+a8O1Xut0X1puLtsvoz:mhJyrOVutsyLtsvo
TLSH
T182826C32AD68AC7B55F2F545F18B32178FF89027E6D86B80D6EC6B1D00ED598130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6b88492-0beb-4742-927e-b127d883f7ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c6b88492-0beb-4742-927e-b127d883f7ff.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 677db5fcb9dc1dbafb5c427d1ebe83b0edf1ac7b8e2680951ad56e1e7342803b
MD5 9f1aa17bd911034cad61b5832a428972
SHA1 4a8e90e71aee35e84f49688790ec2f86084f1515
SHA512 3aea852b1a45b3d8753206e1fefe45b36c1c77a88ec690fd73b65b7cdc9051c48cea1e242969935383b6e370452cd905922d806d9c250731ed0ae91ad0441041
TLSH
T1C3410A58A6EA5248B3B77F569BF6686E487BB9773E06D05D00110D4E0A33B44CCB2B37
MD5 SHA1 SHA512 TLSH

Submit Download