hxxps://click[.]avis-comms[.]international/?qs=ABB7InYiOjEsImQiOjUwMDZ9AAYAAAAABUzYuKQY-tn8RufM8W13D-ZxzPEtd7fTJznfrvn5tNjppe23jEY-oexH_wK4DISRF1CfOEmLntLPOCgeiFsAeCqQjFQ4gH3uICQriKj1

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 07:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://click.avis-comms.international/?qs=ABB7InYiOjEsImQiOjUwMDZ9AAYAAAAABUzYuKQY-tn8RufM8W13D-ZxzPEtd7fTJznfrvn5tNjppe23jEY-oexH_wK4DISRF1CfOEmLntLPOCgeiFsAeCqQjFQ4gH3uICQriKj1
Sample260922-jgpg8a1dpb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4148	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345363254185095"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{A61ABE7D-FCF5-47CD-83C0-008F0B9B18F1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3824	msedge.exe
3824	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 3204	3940	msedge.exe	87
PID 3940 wrote to memory of 4148	3940	msedge.exe	88
PID 3940 wrote to memory of 2104	3940	msedge.exe	89
PID 3940 wrote to memory of 3248	3940	msedge.exe	90
PID 3940 wrote to memory of 2104	3940	msedge.exe	89
PID 3940 wrote to memory of 2104	3940	msedge.exe	89
PID 3940 wrote to memory of 3248	3940	msedge.exe	90
PID 3940 wrote to memory of 2700	3940	msedge.exe	92
PID 3940 wrote to memory of 2700	3940	msedge.exe	92
PID 3940 wrote to memory of 2700	3940	msedge.exe	92
PID 3940 wrote to memory of 1016	3940	msedge.exe	93
PID 3940 wrote to memory of 1016	3940	msedge.exe	93
PID 3940 wrote to memory of 1016	3940	msedge.exe	93
PID 3940 wrote to memory of 5032	3940	msedge.exe	94
PID 3940 wrote to memory of 4856	3940	msedge.exe	95
PID 3940 wrote to memory of 5032	3940	msedge.exe	94
PID 3940 wrote to memory of 5032	3940	msedge.exe	94
PID 3940 wrote to memory of 4856	3940	msedge.exe	95
PID 3940 wrote to memory of 4856	3940	msedge.exe	95
PID 3940 wrote to memory of 3776	3940	msedge.exe	99
PID 3940 wrote to memory of 3776	3940	msedge.exe	99
PID 3940 wrote to memory of 3776	3940	msedge.exe	99
PID 3940 wrote to memory of 4604	3940	msedge.exe	100
PID 3940 wrote to memory of 1644	3940	msedge.exe	101
PID 3940 wrote to memory of 4604	3940	msedge.exe	100
PID 3940 wrote to memory of 1644	3940	msedge.exe	101
PID 3940 wrote to memory of 2816	3940	msedge.exe	103
PID 3940 wrote to memory of 4524	3940	msedge.exe	107
PID 3940 wrote to memory of 4524	3940	msedge.exe	107
PID 3940 wrote to memory of 4524	3940	msedge.exe	107
PID 3940 wrote to memory of 2124	3940	msedge.exe	108
PID 3940 wrote to memory of 2124	3940	msedge.exe	108
PID 3940 wrote to memory of 2124	3940	msedge.exe	108
PID 3940 wrote to memory of 448	3940	msedge.exe	116
PID 3940 wrote to memory of 4304	3940	msedge.exe	117
PID 3940 wrote to memory of 760	3940	msedge.exe	118
PID 3940 wrote to memory of 1836	3940	msedge.exe	129
PID 3940 wrote to memory of 1836	3940	msedge.exe	129
PID 3940 wrote to memory of 3824	3940	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://click.avis-comms.international/?qs=ABB7InYiOjEsImQiOjUwMDZ9AAYAAAAABUzYuKQY-tn8RufM8W13D-ZxzPEtd7fTJznfrvn5tNjppe23jEY-oexH_wK4DISRF1CfOEmLntLPOCgeiFsAeCqQjFQ4gH3uICQriKj1
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ff9b117c188,0x7ff9b117c194,0x7ff9b117c1a0
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,7260516841054813648,671515991865724563,524288 --field-trial-handle=2824,i,16823432575553648361,2281061504223551023,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,17509134001362489691,6186707761167921244,262144 --field-trial-handle=2824,i,16823432575553648361,2281061504223551023,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:2
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,438602936579429336,5977885387490697345,524288 --field-trial-handle=2824,i,16823432575553648361,2281061504223551023,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,10769804186516022363,7701728486187131366,2097152 --field-trial-handle=2824,i,16823432575553648361,2281061504223551023,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,6131809686969025663,8263552318837748696,2097152 --field-trial-handle=2824,i,16823432575553648361,2281061504223551023,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,15932593915157973102,15474503465000813504,2097152 --field-trial-handle=2824,i,16823432575553648361,2281061504223551023,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,6544111236644253032,16692493819805021056,2097152 --field-trial-handle=2824,i,16823432575553648361,2281061504223551023,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3656,i,811595436978147533,7685584315586684124,2097152 --field-trial-handle=2824,i,16823432575553648361,2281061504223551023,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,10314262136500578543,8573426755990928527,524288 --field-trial-handle=2824,i,16823432575553648361,2281061504223551023,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,9791743742849532729,6076444659091801978,524288 --field-trial-handle=2824,i,16823432575553648361,2281061504223551023,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,13694229202975316908,16928328714791463201,524288 --field-trial-handle=2824,i,16823432575553648361,2281061504223551023,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,13694229202975316908,16928328714791463201,524288 --field-trial-handle=2824,i,16823432575553648361,2281061504223551023,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6276,i,10539784654572060621,15723452309930080053,2097152 --field-trial-handle=2824,i,16823432575553648361,2281061504223551023,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6244,i,14430095042343717918,13535705113314273096,2097152 --field-trial-handle=2824,i,16823432575553648361,2281061504223551023,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,5345966095173176920,14538695512000768351,524288 --field-trial-handle=2824,i,16823432575553648361,2281061504223551023,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:8
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,8558572892413865191,9887546830839677311,524288 --field-trial-handle=2824,i,16823432575553648361,2281061504223551023,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,6214088238851472111,8311706903628984055,524288 --field-trial-handle=2824,i,16823432575553648361,2281061504223551023,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,2534583157851777961,10636071365455129430,524288 --field-trial-handle=2824,i,16823432575553648361,2281061504223551023,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5572,i,16180043516435741250,14751033893438609592,262144 --field-trial-handle=2824,i,16823432575553648361,2281061504223551023,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7331d61b72578f10058ae20f1a7351dc99070a754006884c0b775bb57bffd9cc
MD5 df1098b0a62fea8609e624a81ae2865a
SHA1 eb148addd613d8dae155058eacdf967eae295b15
SHA512 0ec5916b4d090394f668a1ee0ca76c2125146f8b8507c9e7dd1bb90a8aed21e61551b85c2a32b975aea241df7bda238c513a58ebe378cd3af3d77e71803ef6d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a9e2856f7b8bdcf4e651903050a9f78a4dcadbc91b2bacca38c04067256642f
MD5 8eed843072749c683b08c3e5dbce9bd8
SHA1 87464a0b34e45a134ed6f01b613378b3b1c952ad
SHA512 ce7dc7d95703c8a1e763fcb3eae4091d89a746632583bc1fc73a8c189a11f08c6f50e2ee328053aab1da82c11d6f5f81942259c5654861d13f267c34e76feb7c
TLSH
T199D02B6CBE989EA0E40210340231910431CBC8178442200648B1065708003C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 221e3dccb30d516b1b3c2d51c604a308dfba3aa3dbe8e11c2d09e185e21df465
MD5 7c97d945db36fde78f76660ee3165916
SHA1 fa851b1197f5a5f6ba4d935baba30b0465e8ad12
SHA512 73a256bc0b95a0662925ed2ac0e1668d7a760da5001e2b32fe139724419020254e080420b21ccad1896c60c44ca2663c2a3d2eccb8cb4180b6b0ad628c68d676
TLSH
T14FD02B6C7ED89EA0E80210340230910431CBC8178442210748B1065708013C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

678729eb-ea7a-4ba6-8cac-d3df82b274fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\678729eb-ea7a-4ba6-8cac-d3df82b274fa.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 0b6899ae11528295dc136336b208d87ff80bfba438fa49fbd089b6ed92493388
MD5 60d24b2c2baea0ece044ba3e96df8a29
SHA1 0ae2ce534e2241d48086b6804ccb92161d3e7ce0
SHA512 9d2cb0d3909bccea1df0a8980fc1e76cff3ae29fe78ce4d7474023b06e957dca0126e31dc3674a94fc87d128eecfb14cb7ff6f64fb61967a173826dc5a200946
SSDEEP 48:1gIWyTRYPS+X1YopYjAV8fxWH3ZZcBZwHmBb4O18RGpRlC8c0jSvM0TZxkrF3EsP:9TmS+lbpYjAVzoQHAbXlCwSvFT4EsHAK
TLSH
T14491B7C1748900BDCB586374E8DC08A7773C167C299B2E01D45BD47CBB2A3B42617EC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe593147.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593147.TMP
Size 3KB
SHA256 ea5ea35fa1dfe9fc6314e67d636b65ea7f5894824bed68941e382fb8cdbda2d0
MD5 e4684f909ddd46512d713e853786e748
SHA1 0acf189a83ae01cb290f2654d50f356fa6367c16
SHA512 3007fa18e327a50045df18038a9092ca442104a56f0ea0fea57e145852518ac362157c085bbddb13673f69bdfd1d347cc0cf37fae81813258e105da4f56d750d
TLSH
T1746182C1649240BDD79803B0BDED2CEBB53C5AB966A3BD10C49BD43DBB4A3B512072C4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 f92a3e3bae535a5ab475a2fa9f591bbe8a50495cde06eb2a7cd86cbcc10a9e66
MD5 38a6eedf96d992df5fd28bec0344fc60
SHA1 c9a5018bc912bb519832492eb9a43e8a426935dc
SHA512 a6104491232aa25c612c427bba49aead99d653e1c3f25aea354b2e7b051d545924a6efed13d8c803539827199ccadadaea64e183097ab9b62d8412c10bedd378
SSDEEP 192:Dx2nN3Vec+HedceSyTrRRCXbfG7Yf8ZYGV7tuG12RlttvzRhFWXLjUOsUyBRAL/U:Dx2nN3Vec+HedceSyTrRRCXbfG7Yf8ZO
TLSH
T1FC32DBB783F4823EC92296F56B14EE1BCE68062A03683935DBD45E47D3E54B1E18274F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 179e2557e0ccff0061d6dfc3fc12d9735f949c98a94a4a89f144606e68bf5c39
MD5 6917326854612b4b31cb969c78997f35
SHA1 0d29d752ca748339ea1c552f261f95c9550d0923
SHA512 6f097331a38a016ec0a2af034d30593752cbc118fde5b0ec291591a0c6baf7682282818bcf562d9c0225446c34b56b04495d238973117ba129430f3383488b6e
SSDEEP 384:Dx2nN3Vec+HedceSyTzXRRCXbI7Yf8ZYGV7tuG12RlttvzRhFWXLjUOsUyBRAL/r:QD4m
TLSH
T1FC42DAB783F4823E892296F56B14FE1BCE68062A03683935DBD45E47D3E54A1E18274F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a3f9f82ae06434b7946cd13b5f8c86f52a512e4b359bea40e99120750d0e7579
MD5 3811b440ae718bbb118340014f689855
SHA1 e515a47d795291a93165f98641cdba0815de7401
SHA512 cbd86bfd126b9801d001c803654f7ab790a155d1db0e5dfcfb1b4f1ce08f22619e44279d0cd73c29a0427190bcbdffb1fc757d140a8517c39a6668c6d6bd4f93
SSDEEP 192:sxZzR5W8/fJsYcndpGtHW6+WNwH3C/Y3bAezIgrJ:sxZzm8/fJsNT6Hbwy/+9
TLSH
T16922CA566E34A97B8CC7D20DBA25BF53E6F9443251D41E48EAFC862C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4ca58f2c9bea275790d2d133f0b7b17a36f8092cbd731de19532a176f07044aa
MD5 bc1f60db32ec7df8ea9ae5952f8d6fff
SHA1 219852160dc821098ade7ecda0535159184fbd4a
SHA512 fb9682519a8f4376d406d88a44c8f7d1e66629bc741e3446a40ec34ef45361600d07b50a4af59f4d100f47fbaae50389ccfef78ed593a8f0143b158f3f80ad17
SSDEEP 192:sxZzR5W8/fJsshndp8tHW6+WNwH3C/Y34AezIg5uJ:sxZzm8/fJsIToHbwy/Bw
TLSH
T1CE22C956AE38697B8CC7D20DBA25BF53E6F9503251941E48EAFCC62C04E76CD221740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 180c2ce5759953ac7792b0ae14c8b480b1fb9ddeb966e334ca277cb10f5618cc
MD5 2ac2fb287b66f8830c01584c1937e43b
SHA1 5fca3fcc584531160834d81f2ba8fbd77bd81776
SHA512 42ed90aa31843656c3ab7778665ab8771928aef8de1c233b2ee1f7c69cac80afa25a5457c40889ed0ce4bfac2bd3714eaae04ff4c73ac89536bcfe1f1885e91f
SSDEEP 192:sxZzR5W8/fJsshndpGtHW6+WNwH3C/Y3CAezIg5uJ:sxZzm8/fJsIT6Hbwy/bw
TLSH
T19122B956AE38697B8CC7D20DBA25BF53E6F9403251951E48EAFCC62C14E76CD221740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 820fb69431fd2c6959771ef28686403783347a3ed63d7d4170ee0a2d1a8370e3
MD5 2e41922be4da5aca446188463698ffe1
SHA1 c0e8a42b57d65a9117cbcb0724ce8596cf65aaa1
SHA512 ef2435ee957095d9c56eb306fda84fb62ba808bb16d692291872d687138a05d8ea522af6fdd0bb4995e654314be47087fee0823a2e03fe10042dfc190166f1bb
SSDEEP 192:sxZzR5W8/fJsscndpGtHW6+WNwH3C/Y3bAezIg58J:sxZzm8/fJspT6Hbwy/+y
TLSH
T19B22CA56AE34A97B8CC7D21DBA25BF53E6F9403251D41E48EAFC862C04E76DD221740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a62cdf7e3674d94f81cf13a959b1f73f55fa7b9e23bee2deca77188378226eb3
MD5 dacfdef8fd5d2a1bc32bd46fdf887935
SHA1 a58a980de057650a657637c30e50e4e9a1cc6b9a
SHA512 65f4651cef76b0f7be486de87de26ac9aecae7b0edc6262a83ab950afae034a04530281b852082999f8f6d672ec084d1a06a03f9858b857c8d84851cfb89cb5d
SSDEEP 768:H530AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72QrolZM7:H530AbSWvS2l9u1jaLmLZ127g
TLSH
T13CC2DA3B640CCB7E4FC01A9DDC6AAF9B6E9C02C796588D4047FA984C02D77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 616d1bb7832e178632ca5f1f756a0ac4316affb791b654d4a3869b47aaaccd44
MD5 fcddda7461541936ab7053311002b766
SHA1 1b753f6c6e4194c0e4663213bfac80d124e8c320
SHA512 47917193beb09700d91aec876c3f3101ffc19f0aef666d98a30f2aefa9dfdc3e5e17f5f5a764070a900cd949fee807e1f195976c1f725d2d33fa6123647a56b5
SSDEEP 48:K06lI064I5bkjUISs5K9Q1K5xipYb8IKyLWRsQO00tbYvAISotK9M1OtxG9Yn4QD:KwhyKSQSmdiK2oNvqKQ8m+z
TLSH
T1DC91546030B75600797D7A5C86A09B5E624136733025F53BBBBE00BA4E6EE081DFE9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6206fea7-5943-4bf4-8b4c-8ca71a8bde09.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6206fea7-5943-4bf4-8b4c-8ca71a8bde09.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5223e03cc1ccce70f09ab48f7e1da3f43e0e579ef03c31456060e701f90707be
MD5 a166148237b4c5cc37d71c0fbf6293ab
SHA1 8bb61ea3a4b79b9cc428c661b9987ebeea405693
SHA512 4332cd470918c7f40ffcc33d1e7af8f8bf03a44b64c692959c0368623f3c1d0c517de45a731c8757aac9988d934c5fc023eaa8d22b5715536d066080582b2339
SSDEEP 384:mZcIhsNnvf7SDpu+cw9iX5FA+eMF4xuvzxV+Mhdp6o9:0hS6M0aE+F44184p6O
TLSH
T1F1828E31AC7C6D7B9CE69245F84736138EB89067E7CC5F90D4ECAB2C01DA6A5131BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 866306f2fce3dbccc1fbfa985d1aa729bf63746633f9d91112431e48b508783e
MD5 c04130fb844bea4928c007abab69a8e9
SHA1 fbc929ea5a430e5a5096e3202d3b57ba635aaed1
SHA512 7dc5384f536e35eba8c29c1a24d8a6e86d5deac187ac8068d570ca8ba513f537d148dc1476dabe95251cf124f6f593d4ae4a70c51d7c59b66fa4938d82bfb324
SSDEEP 384:kiFiZcI5zsN58TUNTUlIluf7SDpu+Fw9iX5FA+eMC4xuvzxV+Mhdp6o9:/FQ5kwgO610aE+C44184p6O
TLSH
T153C219F258E7587AD8AE4743A77D3D028EBCC067B5889A50F7D8561CCC961BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1ddfddca511f63b779f2a9ddd327f861bdb7e878473b43ebee48eb8105b431af
MD5 e812b402f760b6790519b23efb616e24
SHA1 fed49bba52bf8fb84d91149730fa944534cbc706
SHA512 284cb702fb6ce633d22a7d2bb11c90217dba60a118301fead79a425be8e3fc6f54fd92de1eb0b527167c0a7634069dd8126ecac8661e0bbc719abaf302f821a9
SSDEEP 192:LONe6AmwprQmiUyaA6siX5FvY+9JiHXU6:LONe6ipdq6siX5FA+q3U6
TLSH
T15D020B35EC786C7B89F3AE55B58B36239FA9116BD6942F84D9E81B2C01D768C1307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6edc3b2924b58b0187849bafb7b5d48030bebb6a08ae625805f561bb31ab2659
MD5 d9b48707e81e32c1980c370026803ac6
SHA1 75dfa972dc8f9cdfc97c1534eeae5c0ac528f151
SHA512 c2c510c4a19b652aafe17ac024c8c670a8a971c03dd78973b4395efefd499a2536afec824b4d56a553c7647f7127881bbc44854a34a99d86b35fddd942fb73cd
SSDEEP 384:SZcIhsNnuf7SDpu+cw9iX5FA+eMF4xuvzxV+Mhdp6o9:gh/6M0aE+F44184p6O
TLSH
T196828E31AC7C6D7B9CE6A245F84736138EB89067E7CC5F90D4ECAB2C01DA695131BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 de18850db06d40c4663c8cff193a49eee14093381ce6525d80f8f2df618b562e
MD5 ec607cf52ee6a38961aa1beaef60a4b7
SHA1 97e3686d3a0a1295c0687e990e3acbab3a6a16b7
SHA512 c660edda8d5b06a1fb34ff5a009a42f0ac920288d8bc5667a393690ee4b92e69e25a7274a769c8e958aa0e0a24388de9c3cf20d4197954269df798fd824e839a
SSDEEP 192:LONa6AmwpFQmiUyhAwsiX5FvY+eMblRX/QU6:LONa6ipjDwsiX5FA+eM/4U6
TLSH
T1AD123A35E878AC3F8DD2A951F04735138EA9526BDB886F94D5EC2B2C06DF59C530B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec218415-c75a-41bd-9491-7a0b264b81ef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ec218415-c75a-41bd-9491-7a0b264b81ef.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 69cc86500eb9735d4897e441da3be3b46b542d0347bea08349c0601310aab09b
MD5 b3826ca9d8a9c4b1bcafd5da57001394
SHA1 103e8c607ee77074cb1c4af33977af91029fc091
SHA512 11bf73a5597f60d3eee276a4f6452c374958b374fafcd18ba1724b1d8809d1bf679fb7fd5dab4ba0d56ad75b81399942015800fe6c76d1eebf52cd677691f31c
TLSH
T1A141264CB6EA1158B3B76F5A9BF6A8AD487FBC372E0A945D10010D4E0667E40D871B37
MD5 SHA1 SHA512 TLSH

Submit Download