hxxps://projectreal[.]gg/download

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://projectreal.gg/download
Sample260910-wec3mawsgz

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4136	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335361975517312"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{F0A396DD-75EA-4084-B7FE-742ACE25240D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
632	msedge.exe
632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 812	3204	msedge.exe	88
PID 3204 wrote to memory of 4136	3204	msedge.exe	89
PID 3204 wrote to memory of 1444	3204	msedge.exe	90
PID 3204 wrote to memory of 1444	3204	msedge.exe	90
PID 3204 wrote to memory of 1444	3204	msedge.exe	90
PID 3204 wrote to memory of 2656	3204	msedge.exe	92
PID 3204 wrote to memory of 2656	3204	msedge.exe	92
PID 3204 wrote to memory of 3916	3204	msedge.exe	93
PID 3204 wrote to memory of 4188	3204	msedge.exe	94
PID 3204 wrote to memory of 3916	3204	msedge.exe	93
PID 3204 wrote to memory of 3916	3204	msedge.exe	93
PID 3204 wrote to memory of 4188	3204	msedge.exe	94
PID 3204 wrote to memory of 4188	3204	msedge.exe	94
PID 3204 wrote to memory of 4500	3204	msedge.exe	95
PID 3204 wrote to memory of 4352	3204	msedge.exe	96
PID 3204 wrote to memory of 4500	3204	msedge.exe	95
PID 3204 wrote to memory of 4500	3204	msedge.exe	95
PID 3204 wrote to memory of 4352	3204	msedge.exe	96
PID 3204 wrote to memory of 4352	3204	msedge.exe	96
PID 3204 wrote to memory of 1640	3204	msedge.exe	99
PID 3204 wrote to memory of 1996	3204	msedge.exe	100
PID 3204 wrote to memory of 1640	3204	msedge.exe	99
PID 3204 wrote to memory of 1996	3204	msedge.exe	100
PID 3204 wrote to memory of 3936	3204	msedge.exe	102
PID 3204 wrote to memory of 3292	3204	msedge.exe	108
PID 3204 wrote to memory of 4544	3204	msedge.exe	109
PID 3204 wrote to memory of 4436	3204	msedge.exe	110
PID 3204 wrote to memory of 2352	3204	msedge.exe	112
PID 3204 wrote to memory of 2352	3204	msedge.exe	112
PID 3204 wrote to memory of 2352	3204	msedge.exe	112
PID 3204 wrote to memory of 2288	3204	msedge.exe	116
PID 3204 wrote to memory of 2288	3204	msedge.exe	116
PID 3204 wrote to memory of 2288	3204	msedge.exe	116
PID 3204 wrote to memory of 4604	3204	msedge.exe	117
PID 3204 wrote to memory of 4604	3204	msedge.exe	117
PID 3204 wrote to memory of 4604	3204	msedge.exe	117
PID 3204 wrote to memory of 5040	3204	msedge.exe	118
PID 3204 wrote to memory of 5040	3204	msedge.exe	118
PID 3204 wrote to memory of 5040	3204	msedge.exe	118
PID 3204 wrote to memory of 3504	3204	msedge.exe	119
PID 3204 wrote to memory of 3504	3204	msedge.exe	119
PID 3204 wrote to memory of 632	3204	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://projectreal.gg/download
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7fffd1b6c188,0x7fffd1b6c194,0x7fffd1b6c1a0
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,7331467531950874040,11902325851529580501,524288 --field-trial-handle=2228,i,14292981135202988449,5951604245234254609,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1776,i,4546384059948638630,13086497790771895646,262144 --field-trial-handle=2228,i,14292981135202988449,5951604245234254609,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,18364137615584214588,11203852719988522982,524288 --field-trial-handle=2228,i,14292981135202988449,5951604245234254609,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,12924759093061354834,7072182893742901803,2097152 --field-trial-handle=2228,i,14292981135202988449,5951604245234254609,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,5010037237341280102,14125959115911322129,2097152 --field-trial-handle=2228,i,14292981135202988449,5951604245234254609,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,10254852592208759037,6295763442209439178,2097152 --field-trial-handle=2228,i,14292981135202988449,5951604245234254609,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,14500317737614219617,3643682887127969331,2097152 --field-trial-handle=2228,i,14292981135202988449,5951604245234254609,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,6299279901778796237,11907212161303110488,524288 --field-trial-handle=2228,i,14292981135202988449,5951604245234254609,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,10451539680668408118,13165576727977345125,524288 --field-trial-handle=2228,i,14292981135202988449,5951604245234254609,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,3598546966983568204,18102119131457035312,524288 --field-trial-handle=2228,i,14292981135202988449,5951604245234254609,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,3598546966983568204,18102119131457035312,524288 --field-trial-handle=2228,i,14292981135202988449,5951604245234254609,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,5536165240213233077,8400075378306154592,524288 --field-trial-handle=2228,i,14292981135202988449,5951604245234254609,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,14444720209371213116,9126531633517697431,524288 --field-trial-handle=2228,i,14292981135202988449,5951604245234254609,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,7461445987351524370,571814055823314693,524288 --field-trial-handle=2228,i,14292981135202988449,5951604245234254609,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4536,i,16784992608088410366,16231196041938228341,2097152 --field-trial-handle=2228,i,14292981135202988449,5951604245234254609,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6320,i,11122583319771461006,95165599509282658,2097152 --field-trial-handle=2228,i,14292981135202988449,5951604245234254609,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6308,i,14777875414381367608,4742714479826223932,2097152 --field-trial-handle=2228,i,14292981135202988449,5951604245234254609,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6000,i,5352543101354818343,8004301527494391084,2097152 --field-trial-handle=2228,i,14292981135202988449,5951604245234254609,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,14562999964970884612,946030138514492248,524288 --field-trial-handle=2228,i,14292981135202988449,5951604245234254609,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=784,i,2557820594752699974,5851368456952691666,262144 --field-trial-handle=2228,i,14292981135202988449,5951604245234254609,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 965e5ede1dd95e7182bc6ed8b645e4796c53616af10fe7a02b411984e0f5fca1
MD5 252c38f22d645a5fc39fa9f1fdd92b34
SHA1 70c6079cc3ffdcb0efb6f56834b64311e1e951bc
SHA512 e23e1b164567d933593229d39744ddacb3330f715193f293c7aee9a5a95fc433809933ab830a7a1c5cdf37824965c32650c227083092c2a6488a2ab768744ad1
TLSH
T110D09B7077CDAC11D9450471D45547535D96CA4C24D7DB076011801D58567D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 30e744bd07be6735d1b0ab6a541426fb38fe6a0917169c56d6dfd8b1673c6fef
MD5 45de3e18811e1139ab6e0a90b2a939d0
SHA1 d27d935ee61a3db8af7192a11e5083aaf073aa95
SHA512 ea85842b9d197e013aa98887d07b728538fddb340b0ecc52266672ca1f2c87a7eff2fa68dff510c3153dffd9c57ad4df58f0d5b7b40461324e2f08f27923a6dc
TLSH
T1E571A5181251249EDB75E231D5E01723BE32C0F985BB8E390260E9BFA7177E78F1A06C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9528abe480ce8e4641c3696d90e2bc86618ef77b9a16d2cd736b9f0b2654ad4a
MD5 ce0efd8ef30460d9c9ed5e150e6c6fc9
SHA1 37cbc7c8ad72cdd889be11f305e485beac6b2f3d
SHA512 3fc21a03fb4b8d5ead14f90560026d326b870eb35f78b6e548a71c2fe5d4da57ba13f3d8b3d259f9f573d479497eef38a4da227646db7ea6482bb24da618f8f7
TLSH
T1787151182251249EDB71D231C1E117237E32C4FD85BB8E380250E9BFA7177E79B5902C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b244.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b244.TMP
Size 2KB
SHA256 aa72bbae7221118b9923f968ec87b24f6150c6ac6b56070e062fe305520134c1
MD5 9a33f46ea711ce182e4ee5413e92b373
SHA1 1f0f27299f3ea5d04d7c2cfc69f75e2ca35f330a
SHA512 34315b94fa6a6591c3ec77efe3d25be50700aec5c59bbc9a6b1b3456a6f8fb83041d25e7c582f1691ac64a1eb5dd2a94e290f9e867763b288d03fa667c69b691
TLSH
T1EE514D180652649EE730D231C4E01B03BE36C5F989BB8E390290E9BFD7277E79B6901C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 eb9ef9a91eb0858ddd4a8ae16b04350aba2d5b7fe970d77cd79df4dd64bcb83e
MD5 708af7050e64e8b3a70552bb93c4ef1f
SHA1 cfd6bef5a5eaac55867ade10ba5e2ca874f0f9ba
SHA512 40851c8e09942b7913fa3d08f92bee7a51baf5d68d79206b9e873efe400d135b8dca5c5629ee400539267ee0f573c0dd1f5f6ffa2859625e028479cd8936e292
SSDEEP 192:D9EyPSP3PxPWJPHPSPjPuePGP9eNUohw2PfIP/GPWPjPmQPxPjNP8uPePyPEP2HN:D9EyPSP3PxPePHPSPjPPPGP9eNUohw2U
TLSH
T1D7025BF7D3E5872DD92192F85A146F1ACD1E1D24432C3C3ACAD5AF4B97E2871E20264E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 b97da911195ff939ab9e9ad64daf958c9da44e1ac05fb5275bc32dbad235e43f
MD5 1094be81ec3b4b091e1acfff4a6aface
SHA1 aa55a285625bba16025cc9b7f97467c3115cf533
SHA512 29c6176fbabc61395e65f1b2caddb3da8b7bc72b83a49d4a70ec3d8a8458f474b8612012767e0494122926fee1fa70051ad2821b07902982067bc23597e7edcd
SSDEEP 192:D9EyPSP3PxPWJPHPSPjPuePGPcNUohHG2PfIP/GkPWPjPmQPxPjNP8uPePyPEP2s:D9EyPSP3PxPePHPSPjPPPGPcNUohHG2c
TLSH
T1C6F15BF7D3E5876D9D2191F85A146F1ACD1E1D24432C3C3ACAD5AF4B97E2870E20264E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 94346dfe6fb9e637272574a401dc281bafa7cd8b8a911052c2cada3cd28fcca4
MD5 4adf5e96531e394c766de1d3bdda3a10
SHA1 362bf3519fa614de0aa3c58c603fdbd34f5517d7
SHA512 7e2e3092d55b74c21d871acbf1191a6a6e7097c2444956221a85a4b5b28c8bee1bdcfe7aab6d63c845836f4730b27a2a0bc10c4b2e9bec5178637c06e356552f
SSDEEP 192:sxZVIRJyM/jK1Ml8UQ0Wb4/f7Ls5uFIdpHolHW6+WNuLNNLaGC/YwC3nyfIg5IJ:sxZVIjq/b4/f7Ls5u2AHbCXG/4GS
TLSH
T13252D911AA349D77CCDBD209B945BB53D6F9447296941E44AAFCCA1C04E7BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 cbfc8fab6fdbd41bed3b40001b21409a50544081f04fc7758fe9784185c01765
MD5 5c0c461428fbbeeb85c15da2d8a646c6
SHA1 0d94fabe204cd5d4a7a0b541344da9807ac487e0
SHA512 301fdcf45b7b38a7181caf106a525ec10b30ba6b602875e7046511c15a2e0714cdc87d82599de9d7c6fa2f843096c68a503fa367ba373bba81af1a8ff4838fb8
SSDEEP 192:sxZVIRJyM/jK1Ml8MWb4/f7LsriFIdpolHW6+WN3GC/YwuSlfIgrJ:sxZVIjub4/f7Lsri2gHb//d9
TLSH
T1B742E911AA34A97BCCDBD309B9557F53D6F94472A2940E44A9FCCA1C04E6BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9bb52939de438d95d636c16cf69ab35fd295941085f880c5713f591a8269ad88
MD5 5170a249eebaaebed33749242da43d53
SHA1 56f6a5d35b02f80cb76a7a7143f393b9fbaf79f4
SHA512 7769f8786a211d914e94e0e174430cf3a087f418a0ff5d9a6666e1d78a99af8a0273491e710e18e643697127f3f27e80316e3a4dd0aabf1c83280342e3abccde
SSDEEP 768:414jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dvrohScca/:414jeXmWvmKLEu1jacPLZQd8Tn
TLSH
T1A3D20A3B254CCB7E4F844E5CEC26AE976ED801CB6A584D5047FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 9f57da2e602fbdc371026eaec97dfd9cd0db6cfd1866663bea84ebbd8a2f0869
MD5 c0175da26fa0ce35beb27a3b4ab57db4
SHA1 c7f786582cdfcad02c89b65af108202b8a570751
SHA512 2cf025e2c677b045bf78a531395151e1bbc478fb02f65b60a95198e376d3eec800953a6bae303a239457174bd564600d338a648b1dffbaff18c5a9d0f30f2bac
SSDEEP 96:KYBdTRxx89ssmlxKe4mzxibDUlxSWpKKCw1k4KR2qSqIKrCMrCKsMug:Wvdxjfehg
TLSH
T1D2D1135A317F02123DBD2509A2A5C72B4F42B6A33015E52B7B6900B64DA7E351CFCDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6e1b4bf20f1d66a26872300a28530f13e81f98e7c0a0567d8687d3d681450f59
MD5 bcf106010b877d715222ec9984933ca6
SHA1 a32d55501f4eb213b6c3f17436654d918f8f99af
SHA512 03ee57b5cb9c74af0e4808dab8befb24ffef9886a1304de715b675a2c2ce208e220c4ca908da317f8d83a469d83dc52f0131b719e90437cb342eb3ddf147eeb6
SSDEEP 384:kZcIhsNTrsggQqIf+MOetB+2ZF/xuvzxV+MhdpXBooH:ChTZQhOqBlz/4184pXyY
TLSH
T1E6826E716878AC765CF7A244F48776174EF88067AAD8AB80D5ECBF1D008A7A9131EC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 cd732a84d492d2f157e4f14ca74d04692bfee243c7dace6cd70ca9e1e4ec4b40
MD5 90d5c21577c16344e97e895be0c9bc22
SHA1 4a282fa1645f514966e98c0aa5cce0f300a6eb17
SHA512 3277f9ccf03485dc0e1e3354650a35c1d96155208e5681339526cf0f572d042718634e6d51a020d48fe07a6f7ab6134da1b71e85536c17c92ecac1a23dd00b8c
SSDEEP 384:uFiZcI6sNt8TUNTUlIlusggQHIf+MOetB+29F/xuvzxV+MhdpXBooH:uFQ6AwgTsQhOqBlX/4184pXyY
TLSH
T1DCC219F158D79876D8EE9743E77E2E034EBCC067B584A680B3985A1DCC462BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8dcb293dd8f6c50002827901c60d1571ec51f60adc4ef074e444d8363b605e47
MD5 a245fece5a9557a23314ef2dbfa1c293
SHA1 1d5e9334b2b762efcdd7bf9f45412c5043943aa1
SHA512 c6ee01f569bced69916638ec8713950adfa81b12426553daf1d5f37b8fa7b90053de105a6e38cc47c8b813e300e242b095a25b449bc9d6ea2fb670ab0f9cd597
SSDEEP 192:EONg6hZ0QmiUyMapc/+jVqO1Qz5wOZcT9U6:EONg6oipu+MOeK2cBU6
TLSH
T17402E83969686CB78EE2AE45F48737275FE4113BE9956F84E6E81B1D00C779C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c95ba317eed90a1792e9d9ee01c392ba128521d5cf95bf9b6e5b2825fc5896b9
MD5 180c15dd6bfbf88037b646bcd202815a
SHA1 7373225d2302a2d1da36099b7510b0c4cb97fa50
SHA512 ce4c995d2d1bdcb8b925e517cd3ebeffe35acb04baf999c7b047c47888ac87d976eedad10cf5f2ca9359d28972005579e69f8b09bd8ed5cdd162ccb1333a43d4
SSDEEP 384:KZcIhsNTusggQqIf+MOetB+2ZF/xuvzxV+MhdpXBooH:ohUZQhOqBlz/4184pXyY
TLSH
T195826E716878AC765CF7E244F48776174EF8806BAAD86F80D5ECBF1D008A7A9131AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fe9689d33fe092791fc17a7d894328eaa6dd75a321bf4825b8ea89fe45cec671
MD5 115db0b756e70211d2c75b4178ace35e
SHA1 cb656bf9dd64ac3a922b90016eb2b6b9f19889cd
SHA512 51852ca48f915ae88109b8abaf3eb4be58e5d2aff658465c1ef3a15affd8cdd51c0cf4e24884376ba887126bd450e8575c6b987f566c5d51cd9ff6491d07e653
SSDEEP 192:5ON26hZAQmiUyqa4c/+jVqO1QtB+2b05cOquqjU6:5ON26kW4u+MOetB+2j9/U6
TLSH
T1E3121B356968AC774DE2A645F48736578EE5512BEAC5BFC0D5DC2F1D00CFA6C230B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6515ac8-7146-4f58-9590-69027f4f6290.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d6515ac8-7146-4f58-9590-69027f4f6290.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c6ff748c05f5f694b6e62108d8bcecf1cd22ba7274149b5aa92dd81098501517
MD5 1bdaa6314a06ba155b73a400df192f92
SHA1 1844c24221e1f56fbf3932becdf344bf85be155a
SHA512 f3ea791ef079e65d4e3bb3fe85751f6d6ff563328b60ca76178e8eaac80c06e0b93a34d7e9b3bfff7c297cbf7ba8c58840fcedf9a9fb8fa561848db12bbce9d2
TLSH
T14E412C5CBAEA1148B3B77E0AABF7A86D487EB8732F46D55D10010E4F0677A40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download