hxxp://rivcas[.]com

Analysis

user interaction
yes
max time kernel
78s
max time network
77s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://rivcas.com
Sample260910-aeg6patzhx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4972	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334724544807309"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{B49BE325-B6C7-4931-9A7B-5A58BF1E5E86}	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 1808	3564	msedge.exe	85
PID 3564 wrote to memory of 4972	3564	msedge.exe	86
PID 3564 wrote to memory of 4140	3564	msedge.exe	87
PID 3564 wrote to memory of 4140	3564	msedge.exe	87
PID 3564 wrote to memory of 4140	3564	msedge.exe	87
PID 3564 wrote to memory of 3632	3564	msedge.exe	88
PID 3564 wrote to memory of 3632	3564	msedge.exe	88
PID 3564 wrote to memory of 2108	3564	msedge.exe	89
PID 3564 wrote to memory of 2108	3564	msedge.exe	89
PID 3564 wrote to memory of 3848	3564	msedge.exe	90
PID 3564 wrote to memory of 2108	3564	msedge.exe	89
PID 3564 wrote to memory of 3848	3564	msedge.exe	90
PID 3564 wrote to memory of 3848	3564	msedge.exe	90
PID 3564 wrote to memory of 2164	3564	msedge.exe	92
PID 3564 wrote to memory of 2164	3564	msedge.exe	92
PID 3564 wrote to memory of 2164	3564	msedge.exe	92
PID 3564 wrote to memory of 4644	3564	msedge.exe	93
PID 3564 wrote to memory of 4644	3564	msedge.exe	93
PID 3564 wrote to memory of 4644	3564	msedge.exe	93
PID 3564 wrote to memory of 4932	3564	msedge.exe	96
PID 3564 wrote to memory of 4932	3564	msedge.exe	96
PID 3564 wrote to memory of 4932	3564	msedge.exe	96
PID 3564 wrote to memory of 1468	3564	msedge.exe	98
PID 3564 wrote to memory of 1468	3564	msedge.exe	98
PID 3564 wrote to memory of 1468	3564	msedge.exe	98
PID 3564 wrote to memory of 1676	3564	msedge.exe	99
PID 3564 wrote to memory of 1676	3564	msedge.exe	99
PID 3564 wrote to memory of 1676	3564	msedge.exe	99
PID 3564 wrote to memory of 4476	3564	msedge.exe	100
PID 3564 wrote to memory of 1252	3564	msedge.exe	101
PID 3564 wrote to memory of 4476	3564	msedge.exe	100
PID 3564 wrote to memory of 1252	3564	msedge.exe	101
PID 3564 wrote to memory of 3980	3564	msedge.exe	103
PID 3564 wrote to memory of 4564	3564	msedge.exe	118
PID 3564 wrote to memory of 3044	3564	msedge.exe	119
PID 3564 wrote to memory of 2648	3564	msedge.exe	120
PID 3564 wrote to memory of 3980	3564	msedge.exe	122
PID 3564 wrote to memory of 3980	3564	msedge.exe	122
PID 3564 wrote to memory of 2872	3564	msedge.exe	123
PID 3564 wrote to memory of 2872	3564	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://rivcas.com
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffc052fc188,0x7ffc052fc194,0x7ffc052fc1a0
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,9680389238572394318,4045178864322847814,524288 --field-trial-handle=2256,i,2971986312209921896,15038545775485399369,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,14555644569861293534,2794886251821095065,262144 --field-trial-handle=2256,i,2971986312209921896,15038545775485399369,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,14233865422912675920,1809693320084905458,524288 --field-trial-handle=2256,i,2971986312209921896,15038545775485399369,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,8435908831925880330,2660075870149261696,2097152 --field-trial-handle=2256,i,2971986312209921896,15038545775485399369,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,10938773098441788779,15874147683474335232,2097152 --field-trial-handle=2256,i,2971986312209921896,15038545775485399369,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,3257834185790583440,3024812494091545122,2097152 --field-trial-handle=2256,i,2971986312209921896,15038545775485399369,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,1823281141402925787,10296700604923336594,2097152 --field-trial-handle=2256,i,2971986312209921896,15038545775485399369,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5056,i,18046971139527038843,16876831839294315449,2097152 --field-trial-handle=2256,i,2971986312209921896,15038545775485399369,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5256,i,5296101404616005716,18288675302611767924,2097152 --field-trial-handle=2256,i,2971986312209921896,15038545775485399369,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5064,i,11296188144869106488,14508701323445121959,2097152 --field-trial-handle=2256,i,2971986312209921896,15038545775485399369,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,1362177002451739016,11499300766595155880,524288 --field-trial-handle=2256,i,2971986312209921896,15038545775485399369,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,15343812118437002455,9233056081884460989,524288 --field-trial-handle=2256,i,2971986312209921896,15038545775485399369,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,13367335281229116516,14262476067676348603,524288 --field-trial-handle=2256,i,2971986312209921896,15038545775485399369,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,13367335281229116516,14262476067676348603,524288 --field-trial-handle=2256,i,2971986312209921896,15038545775485399369,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,3000488609549219563,10349050473789987662,524288 --field-trial-handle=2256,i,2971986312209921896,15038545775485399369,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,7193740843309523598,16090786772247522105,524288 --field-trial-handle=2256,i,2971986312209921896,15038545775485399369,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,15108249973391980788,2993279925174045014,524288 --field-trial-handle=2256,i,2971986312209921896,15038545775485399369,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,16800446708615908818,13664553835342263452,524288 --field-trial-handle=2256,i,2971986312209921896,15038545775485399369,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,13267319709186425259,16776236628813493328,524288 --field-trial-handle=2256,i,2971986312209921896,15038545775485399369,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:2872

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6cc06db2c5b40cc01f823722bf996557b3d025c493549e730f4ad3088a1858e2
MD5 ef423fa7ac3427d91517049713053435
SHA1 736d287d9c6af2751201336def2155a9176d2050
SHA512 2f919ad8b8c6b62c797889e6d32557700f6f48d3cabab5190b19e9025ed824fc7ec00e7191dbebc91083ccff2407b2748f4724d1d2c306d17648ce68825f5711
TLSH
T11F516E3C1A520862EBD10533F0FB8A54717A81DDFA13AE73C6B3AD7A5B0A325C10D389
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1fb67c9b43310a0f2888c76722e6990ac00adc921eaa72b2dc8146a4b8d59ed5
MD5 d2e51769692117409f96be636f5336fe
SHA1 85af5b347b514025231abe689521fda8ac819c5b
SHA512 49ba8da36875828b9186e04e549710ce5082b704059bc8456bc6807ac6cfac8752d4f3e7acb9509424afc56f1e4e45be2c375be29eae4669f0b761167406cf7d
TLSH
T1D261633D2551281AEB810433F0FB8961717981E8FA179F3FD973E8796F1A361C20D299
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d7ec.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d7ec.TMP
Size 2KB
SHA256 292e0dca46b4881d3ab14460b414194a7911eaaa7258b07801bf74bdb3db245c
MD5 0df5a0e97a5735cfc3a264215a450bcb
SHA1 4792ae6b1bae2c64ed21454157e3f5a27eb5fac1
SHA512 2bab9bdb6d0216502a1b78cde2f14d9c6a7c7811f583737cfb14963398cd7195543bdb4922b16c2c27968e421ccb08ed05cd352a89dee6901b5ce38d01bd26b1
TLSH
T11B516E3C1A120862EB900433F0FB8A54B17985DDFA13AE73C5B36D7A5B0A321C40D389
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 20bbe59880ac115620f29cbdc05a2c58d6d3b7fb948db2297d545d0d458524d9
MD5 53349daec0789518ea77d2e088306814
SHA1 220529ecc00d7d4dbcc087ff7736a3b0d29dc28d
SHA512 51cf975fb2967bcdcda20be521f88a4ccef3fc538572db72c387c729d6ea094ea47753cc82e5779053db5a05d3ed2dd16e5f78de163718da2231c0448342789e
TLSH
T1F28179F783E5C62DE9115AF05A18AE2ACEAD0614436C3C6689D4BF5B93F3071E102B5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 e379492c226f8382108036cdf45738d11747e832ddea713576fff992bbad1f95
MD5 d4aebafac9e567355b87e6bd7f939a5c
SHA1 854e7ab6eefc59fd95772a760d0e20c4190d1f5e
SHA512 a2816eb082c67c441d356341734c9643e8b021c392ab27b642351e6dc506e6d848f4ea368ced025abcf73aa1651102e1db4d829c2f9468631386b244a4347c90
SSDEEP 192:sxZPRvWY/fys/JgcMiIdpWxHW6+WN1j7/Y9IHC4YIgrJ:sxZP8Y/fys/9C+HbJ/m9
TLSH
T1B222A8166E28A97B8CCBD30DBB19BF13E6F9503255951E58EAFC861C04E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b5303d3c95a5f44c301bcc595a2c1c4d2dbcb1bd362fabfcb931fe945b563aba
MD5 210886456b59d995a2e3a9f3fc844df2
SHA1 b424b50df0b32dc38813c598c485b03755b405cc
SHA512 0fbf0eb674638d17ce1f592d545c5a46223dacaf9eea135d23d53b9c775a72c9953dbd090bab267cc922aa03470adbd394d839fdb1e979fc033d0352a4f8c868
SSDEEP 192:sxZPRWWY/fys+kgcMiIdpMLHW6+WN17oxY9Ikh4YIg5rJ:sxZPvY/fys+QCeHbix2j
TLSH
T10F22C9166E38697B8CCBD21DBA19BF13E6F9503256D11E58EAFC861C04E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f5ef0620a16b34cf7a4ed3099e52ebbb491a297884c6a02d899916db9489ef60
MD5 1f100b10d9612a81878acabd79bf2674
SHA1 70744c23b8e090247c2542a3d52f30dbb8c40f12
SHA512 fc71ce1a670b559b28a6fbe551084022777c690728840dcedb4ade9d2c29c47067d5ab8bf0a4216ad2064332c2a71708ae4576bfb851c1d63423959351853a1f
SSDEEP 192:sxZPRvWY/fys+JgcMiIdpWxHW6+WN1j7/Y9IHC4YIg5xJ:sxZP8Y/fys+9C+HbJ/mt
TLSH
T16122B7166E38A97B8CCBD309BB19BF13E6F9503291D51E58EAFC861C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 381a734b55a3edda2a6aac059e75d6b3955a8e67d05364d9ea1009679dd1a56c
MD5 83eb347eb5042956c28487e794ec72f0
SHA1 11f0c39dd25665f796af4e209eafc9bb89e88250
SHA512 8de6e26676ec8e7b12ddf2918dd14b934c18dcec0b45252b4e03f24a5366418cf535f7299f03a1c6bcc37dbf36a2bbe96922a2874cded1ba868728fda3a8327b
SSDEEP 192:sxZPRWWY/fys+kgcMiIdpWLHW6+WN1HUdY9Id64YIg5rJ:sxZPvY/fys+QCgHbid0j
TLSH
T1FA22B7126E38697B8CCAE209BA15BF13E6F9503255D51E58EAFC861C05E7ADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0352fb4a977ffb2b9998a6a8e2d3f99a60ecc3099eaf7467ee0b42af4ab945ac
MD5 7e9c6f7fa99afd48592f2d207fee4ac0
SHA1 314ee0543cdb59ec8a6464cca1db8f0f667d98f8
SHA512 d73cc58e61ee0d2fd1b1d83b704db92475888128f2ac487e9b57e35923a47a78b4e836ab922906fe95862499aec943b4a71554c5904bc20bcdcff8ef9403437b
SSDEEP 192:sxZPRvWY/fys+kgcMiIdpWLHW6+WN1JGXY9Iv64YIg5rJ:sxZP8Y/fys+QCgHbeXGj
TLSH
T16622B8166E28697B8CCBE209BB15BF13E6F9503291951E58EAFCC61C05E7ADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a033f051d26d983f5e2b34c3b52428adf93b1640033d016d9b7c1f47d3f3d685
MD5 0f246f3a3b84593e324581a838de2112
SHA1 225b92cda45e9b357e0967be68ec4d65ff514773
SHA512 72363cd22046eb71a4b4be38267196ae185c941d0ffd0762a3a688a937f6b153f89e78c03afa312dd3868a94bf2e7dc660fc2c7acd4b25ef7fdee535c7b4d0e6
SSDEEP 768:7xyvIZwWvu+I+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW7crocbOv:7xyvIZwWvu+I+u1jamFLeR7Hcy
TLSH
T10AC2E93B240CCB7E5FC01E9D9D5A6F9B3EA802CB67588D4047F9994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0d4c7817147e6d96fd6aaba5baf5cf01f720e247a04e7c1e6f84d43d19ea59eb
MD5 e2beffffa1fa3d041d5b127d10155f4d
SHA1 2eedfedb4128297c7e337fbc99716386e3027133
SHA512 b5e3a5d8c91336cc2b76d01c557d0cfed3fa380fbb70f780cf6e3c3baf4f00722e13bd6f17b656fa26cc74d167836771e442a40d8faa3b4466ad8295c277d29f
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDi1pqKKAqKwAK9Cm:mTvh/j
TLSH
T118917015717A0645783E690C9351873BAE423A63749CE63F7BAC41A18E2BE07DDFC4E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1df46a2-2496-45fa-9cdf-c84159286b6c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b1df46a2-2496-45fa-9cdf-c84159286b6c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 881491fa66908bc7613e7ec2495ac2a764f059f4d6b1899e0d8aff8d08a7ac6b
MD5 56fb8ccf3e64c204b69268a3cdf45dbd
SHA1 b48c7e1e6b187c58cfb1f21767e1c29b1142e5c6
SHA512 1feaa4d7342cf50307d51895d41de12e2c8712a11ffcab81a4c4659fd4d9876ac62b9ad617f4377f38507a9459ebcd183b49296d3ceff5993f7b8b1ea74bdb07
SSDEEP 384:GZcIhsN8R/gltzitmhRue+C9d6NXeaesa+VYHou:UhGl95HFoehgYJ
TLSH
T18A827C325D385DBA99F29781F94776039EF89167A6CD3F90D1E8AF0C01EB6981307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 05f9c20ed58a86ac82c4f08f5f76e851f7190411707f139f3bb3256c56da77b3
MD5 842150b4e13cbec0b7fbcd9961d3db17
SHA1 beded58706fd7148177eb9645e09e64a163d9441
SHA512 d4ee54ae84658ff5589b7d89509f52ed7bd98eb8f690a9da3bc29aef418e0497baceaa331142637ad3aedc64489318c260e37fc002f24cda0247347d2c04d7bd
SSDEEP 384:GiFiZcILIsN08TUNTUlIly/gltzitm0Rue+C9d6NXebesa+VYHou:tFQEpwg/l98HFFehgYJ
TLSH
T19CC22BF248D7897AD9AE4743EB7E2D024DBCC167B5856A50B3D85A0CCC961BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6cb51df275b7e11d63e662669618ebd3d2580794890263adb118c16577e13ef0
MD5 fc56628b95bd53afaa4125adc6885457
SHA1 da06845e57fea0f9abc712c12b45dece47edb5e2
SHA512 c0461aa64cc0b966bdd95817145108d475b7aaeea472adec043cfd23f63c58512beaed7c027ac18e0aa68479981d7e965b75ab8bd9c846b6244bad2886c1b9d0
SSDEEP 192:JONWS6v+YLNQmiUy8hZh+CGX+FdeNNmuszpU6:JONT6vz/7Zh+C9d6NIVU6
TLSH
T14E02D835AD382C6B9AF2AE05F48737135FA42177EA962B91DAD82E1C01D775C2306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5910cf39a05ee6263d7e1a1cc58dcf8725338259e275d8bf63c4801714d1ba19
MD5 9ccb1dce4383fe81ba96a8f6cc1c1831
SHA1 e8a5e0c662fb12a84ce49ff788cbe591e8b64019
SHA512 91796c31686ceacab074da2f7ba59ad88616c3681db9c6dce458a68d9d99ef4bb15f00f3651987dc3a08e3ed0cfcab94d8d11c0c43606d9a5ff7d966ab6378ea
SSDEEP 192:bONt6v+YL9QmiUyU6h8h+CGX+FdeNNkGQNICHOqKU6:bONt6vzXxc8h+C9d6NXepeU6
TLSH
T10F122C35AD786C6B5EE2A941F48336135EA49277EE8A3F90E5DC2F1C01DF65C230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a481c515cbcfc7b5849e5998d923bee3076186f905535a0f4b05d8c09cc38711
MD5 ad02df15e6cc74501e65ebcae64465c6
SHA1 37261f5189d457036210bbf0f62d489ddfee8bfb
SHA512 30c5bfe7da367426e4bf7376d2ee5a2d668193f08e3ffa2eb166766876a75ab87aad36015c05094f02d7d1f08de9b388d3ac2b4981f70f296d2d7785f7e88306
SSDEEP 384:rZcIhsN8y/gltzitmhRue+C9d6NXeaesa+VYHou:zh9l95HFoehgYJ
TLSH
T1B8827C322D385D6A99F29781F94736039EF88167A6CD3F90D1ECAF0D01EB6981307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d426afc9-0b25-4d31-b861-960adc62d493.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d426afc9-0b25-4d31-b861-960adc62d493.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f0bf6bbf8738641e1568983e6a6bc2e97fa44c1d0b1cd7d360e2e8666c85f0c9
MD5 e59cd44ffc9f8cec2580342756ca3391
SHA1 fd6ef4ac6260f270bb28459b4a7d7516505b311f
SHA512 add8b39bb53435f5a8fbcabdb996a1101cf54584f9bfc3190ce400837b81a330eb8bbd8fc2b4cf55e096f593907f34fb8afce598f0d315d9fdfcaddc7f1639ea
TLSH
T10A411848B6F91108B3B77E56ABF6696D487EB8772E06949D10010E4F4667A40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/3980-176-0x0000029BB0EF0000-0x0000029BB1039000-memory.dmp

Download

memory/3980-175-0x0000029BB0EF0000-0x0000029BB1039000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads