2664c5006f4d4d31fb61e744d1882f9f83d6a2a21cd194c676692946ab5563cf

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EpicTools-Extension.html
Size 4KB
Sample260922-nc2n7sch96
SHA256 2664c5006f4d4d31fb61e744d1882f9f83d6a2a21cd194c676692946ab5563cf
MD5 cb71fcdbf9e4897134c5b2b1ad687119
SHA1 500bea503bce1f48c84ffa0189c1f4934c0c69c2
SHA512 34c3ae3adccfddc04c079c0ee8ddd8ba048c4e292b689575973d57c576310c9da52d344cce49438747614cc2ee75b055ab06d92a4145045fc46ddceb5f5e9f0d
SSDEEP 96:fjFj7jOjEDDK/D5DMFLzLexV3EmeZNeBuc7RslvaQxvbzM:fjFj7jOjEHK/VoPyj0meZyuc7qlCejzM
TLSH
T189B1A572F9BD117F1093927271BDA70A7AA0D143DA9A18903ABCC2755F8EF45AE072C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5564	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345493634439312"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{8690E9E0-32F2-4DC8-ABCB-54E4EB9D900C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3520	msedge.exe
3520	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 4568	3152	msedge.exe	88
PID 3152 wrote to memory of 3432	3152	msedge.exe	89
PID 3152 wrote to memory of 5564	3152	msedge.exe	90
PID 3152 wrote to memory of 3432	3152	msedge.exe	89
PID 3152 wrote to memory of 3432	3152	msedge.exe	89
PID 3152 wrote to memory of 5696	3152	msedge.exe	92
PID 3152 wrote to memory of 5696	3152	msedge.exe	92
PID 3152 wrote to memory of 800	3152	msedge.exe	93
PID 3152 wrote to memory of 800	3152	msedge.exe	93
PID 3152 wrote to memory of 412	3152	msedge.exe	94
PID 3152 wrote to memory of 800	3152	msedge.exe	93
PID 3152 wrote to memory of 412	3152	msedge.exe	94
PID 3152 wrote to memory of 412	3152	msedge.exe	94
PID 3152 wrote to memory of 2124	3152	msedge.exe	95
PID 3152 wrote to memory of 2124	3152	msedge.exe	95
PID 3152 wrote to memory of 2124	3152	msedge.exe	95
PID 3152 wrote to memory of 1072	3152	msedge.exe	96
PID 3152 wrote to memory of 1072	3152	msedge.exe	96
PID 3152 wrote to memory of 1072	3152	msedge.exe	96
PID 3152 wrote to memory of 2360	3152	msedge.exe	98
PID 3152 wrote to memory of 2360	3152	msedge.exe	98
PID 3152 wrote to memory of 2360	3152	msedge.exe	98
PID 3152 wrote to memory of 3104	3152	msedge.exe	100
PID 3152 wrote to memory of 2428	3152	msedge.exe	99
PID 3152 wrote to memory of 3104	3152	msedge.exe	100
PID 3152 wrote to memory of 2428	3152	msedge.exe	99
PID 3152 wrote to memory of 5976	3152	msedge.exe	101
PID 3152 wrote to memory of 5976	3152	msedge.exe	101
PID 3152 wrote to memory of 5976	3152	msedge.exe	101
PID 3152 wrote to memory of 1464	3152	msedge.exe	103
PID 3152 wrote to memory of 4652	3152	msedge.exe	107
PID 3152 wrote to memory of 4656	3152	msedge.exe	108
PID 3152 wrote to memory of 4124	3152	msedge.exe	109
PID 3152 wrote to memory of 3764	3152	msedge.exe	110
PID 3152 wrote to memory of 3764	3152	msedge.exe	110
PID 3152 wrote to memory of 3520	3152	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\EpicTools-Extension.html
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d4,0x7ff9ae1bc188,0x7ff9ae1bc194,0x7ff9ae1bc1a0
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,6302012067571956823,14812549192330323608,262144 --field-trial-handle=2240,i,12344950720446143249,5280481700720697334,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,11290089129352477322,9057862252542262346,524288 --field-trial-handle=2240,i,12344950720446143249,5280481700720697334,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,17715594931371868780,14046640953232934980,524288 --field-trial-handle=2240,i,12344950720446143249,5280481700720697334,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:13
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,1302271280067136363,12556801177709384658,2097152 --field-trial-handle=2240,i,12344950720446143249,5280481700720697334,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,13003362782323284286,12935710079815877699,2097152 --field-trial-handle=2240,i,12344950720446143249,5280481700720697334,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,6124075523965184463,7156265823374241034,2097152 --field-trial-handle=2240,i,12344950720446143249,5280481700720697334,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,1817603178537549052,16823475874390002980,2097152 --field-trial-handle=2240,i,12344950720446143249,5280481700720697334,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:9
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3864,i,14658213972268973970,17224636656935547310,2097152 --field-trial-handle=2240,i,12344950720446143249,5280481700720697334,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,2683870927730341348,16643624791724359480,524288 --field-trial-handle=2240,i,12344950720446143249,5280481700720697334,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,2798303064572800557,11455682718680903021,524288 --field-trial-handle=2240,i,12344950720446143249,5280481700720697334,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5880,i,13615418689717749434,10446227607520482609,2097152 --field-trial-handle=2240,i,12344950720446143249,5280481700720697334,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,9493551175823899449,5420537354675620077,524288 --field-trial-handle=2240,i,12344950720446143249,5280481700720697334,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,9493551175823899449,5420537354675620077,524288 --field-trial-handle=2240,i,12344950720446143249,5280481700720697334,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4684,i,1699061160020818719,114646949742470004,524288 --field-trial-handle=2240,i,12344950720446143249,5280481700720697334,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,5263529376982233889,12555738546047088572,524288 --field-trial-handle=2240,i,12344950720446143249,5280481700720697334,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,5495561830193172411,5846351957963055903,524288 --field-trial-handle=2240,i,12344950720446143249,5280481700720697334,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:14
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,17002871736362717575,18247372374408256014,524288 --field-trial-handle=2240,i,12344950720446143249,5280481700720697334,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=820,i,16189476017415606009,10247174183150920830,262144 --field-trial-handle=2240,i,12344950720446143249,5280481700720697334,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08b551008bdcc4de6c80e8d8ffe37c1b7477ababb9604ca97c52b81aed70fdae
MD5 4cd8e5e902146ba19eacbbf4f2e5586c
SHA1 94f807b68c16fd008173350beb37c8686810bcbd
SHA512 6381a86b9ddf9099cf403e36e8c774a996a2a9e547c95e0b2070ef6e2e5e94028cf8284c9fb284f5f80b523066ed68d34895e768192628c20598a4e881c034ca
TLSH
T1D5D02BF4B7DCD543C084507400F11574113571306918C2F02311E18805042810512329
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6a4f25194d7df920f023b94035789770d82b866f099f5b5c173cc54b917115
MD5 3f1c1794ec8ced524804973bbce2d4ac
SHA1 6590c89953e8a722e5a484b9a6cf54a706728368
SHA512 4d64e702748a9bdaaf0d9e615e1a53c00d60b36678bc7c8cbf081669c63c3b8c23886cf0b3633e50e54853f273a2e585b73bb1a35f53ef1493bf40ac357ee359
TLSH
T1F1D02BF0B7ECD443C084507800F21574112571301518C2F02311E18805042810511315
MD5 SHA1 SHA512 TLSH

Submit Download

4d124f1d-4f4f-4bf1-92b1-e9f1e946373e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4d124f1d-4f4f-4bf1-92b1-e9f1e946373e.tmp
Size 11KB
SHA256 e97bea5c49349d67ec37194c202f0a4368765d5ef83db34d64db1f1ea5a3580d
MD5 5fd6b2c8285a1679776282afc1a89c94
SHA1 762ed6ddf9e1c343785ec7c6b5ad42bbccebb08e
SHA512 940b18f655fd244cc0c0f468e55c81eace08e8bf398ac90a5b50574ea1355b9b6cf3ee6abcc3a8d4904b98e75f87ec1ae831cddc4b0853c9de18b499788c5907
SSDEEP 192:sxRcRGbX/fbsKCq1zoA8p4+/g6+WNIYRLf3jqGSIgIJ:sxRc2X/fbsKCjL/5IE4s
TLSH
T15232C619AD68A93B8CCBD21DBB667F53D6F9503361D11E08E6FC861C14EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 df1541be3cea577de7efeb7d09e9301682611fa0d2c0b99f9720dc0c6283bbed
MD5 bad28a3c16f1f152160440d6e9ce10d8
SHA1 47ac56b6d532c7cb7bffbc0201337d8e2c7fcc29
SHA512 ffdb18931bb8068a503df9307764f30a7ef8a1387542d0c726ac4c355bc7e74c58b9f39419bdc0fa26f15ec557bdb22e85c75964806b46c4f649e21b31a5c209
TLSH
T1F561F847936148A0E7AE217A91D00C873A34B9FDDD830F385794F77828567E962F44F9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a27fc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a27fc.TMP
Size 3KB
SHA256 7dd1c4d1468dcfa1ab3dc77eac43010534054495e761e14ca3f7b36e0633ba4b
MD5 14eb417c631a1900ec85d9422ca48ea5
SHA1 5fe0073ba00586c7b81a781eeb3cb02ec8fa92a3
SHA512 e0cfe6a929d593d4dbf77c30f3b4b63746658db72d70f3e01a51d749457b776d5affd9d688e6e0231f41781c8247da2c6f092f788004df21101ec68c5d59c9e0
TLSH
T10B611A47936148A0E7AE217A94E00C873A34B9FDDD830F385794F37828567E962F44F9
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f8451f1ce760793c615ff92cc5a0587df905b173d6499fe0532cc0d0038bb6f4
MD5 1f8227e68c94207cc74c1703840bbe81
SHA1 c5254f286733e8f7f41a8b4570318766b6e856dc
SHA512 1cb97bb203b27c223a9b9ec6204c7c51101cebdbabd96ce0615351abee335f5410470a41ad0667c9e080e700499ad4b05937ee3a388cef24b3d4dbe75fe853d5
TLSH
T111519FF7C3E8877E891156F0AB286E2BCE2D0516422C3C5689E4EF1F63E24B1D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c85474fa75696b02e8af61164ff20bf04426e40fd351c452781f870f70b1340b
MD5 d34575a3f8892af6997b7977898d7c0f
SHA1 75ff21f81fbf1123aa2012128a2348ce71fb9d90
SHA512 9890a171da4711f9c578ef740adce3e712ab271cf1a1dd140c648fa06bd31107a98af8162c15a53b4496fbe25eb08b49947e9148120d87577ee1935f95fc2b32
SSDEEP 192:sxR7RGbX/fbseCq1zoA8p4+/g6+WNIYRLl3jqGSIgDGJ:sxR72X/fbseCjL/5IC4e
TLSH
T1E932D719AD68A93B8CCBE21DBB567F53D6F9503360D11E08A6FC871C14EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5b2a432b40b4d3cbce7ad03893e5b5aaff3ba8790d00b0676eedf076c3294b7e
MD5 34ff741152c452d64361dd7ff36cba1b
SHA1 909f9ea4e2db30dad05ee17b7304175302ad37f1
SHA512 3862f84381efd339c3b95e1b1dd5af0997c1ed78dca968955404051bb47d7f50238f76202c8b6262649371361d85d48a52cb98b29349fd3005e538536efb9ec0
SSDEEP 192:sxR7RGbX/fbs9Cq1zoA8p4+/g6+WNIYRLf3jqGSIgDUJ:sxR72X/fbs9CjL/5IE4E
TLSH
T19032C619AD68A93B8CCBD31DBB567F53D6F9503361D11E08A6FC861C14EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 60ae6ee2d7082d41bab684407dc43c5d2ca45fb677c3b0d3cd491e4f7b6996f5
MD5 f900a73a5cca795b4de57d1c3092e376
SHA1 0ccb656a9a21c97f303cc4afff0ca31574dd8a86
SHA512 3cb43f207b2a2b8d7d4413ffb7b1675837327acb5a4ffb033433346be2f871abc873dc5eed5417a979c25629475e4f9449e771e416d3d6d09244f604008e9749
SSDEEP 384:Ua5g+TcfCtgflFfzHKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVwE9tTRkLroqmR:UEg+TuWgf/fzH8F1+UoAYDCx9Tuqh0VC
TLSH
T1E5B2CA2F644CCB7E4FC10AAD9C1AAFD76D9802C797548E4047FE994C02C77FA921A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8f4791c4b75b5298fdf691699bdee6176e4f8757489d16ecca423f3019b11872
MD5 ca8ce9d456e28b5a5b093448129776f3
SHA1 f128400fab47a0dc9d5e87fec3187837dfbc24d0
SHA512 ff0f8c4e624a0b0afc8a459d17bf83f2bb7d49e545eaa4aed908d3ef420ccfa462133ab17fce7d49288f2d1eaf102451616273f0aa8b3b60dbb4a546ca5584cc
SSDEEP 24:Klzs3o/IHKzh21CSydryXngbwQaIFKIh41mSNWYCdKYQIxKmhw1SSPQdyX+BuW:KEoIHKV2sTyF1IFK+4AmzIxKQwU7yi
TLSH
T1C9917210327B0602B87D384898D19B6E965136E33178E62B77EE04A64E7BE040DFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ac2e4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ac2e4.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 8a571e6bb193783a3ca1d9b877c4cfad757cbea4e89dd8d1c5f9fdc94a9bf6ea
MD5 52cc885443ff581ff9f58fdeed013a7d
SHA1 d447f453a65a1e7d1995dd0a2692cdbfbf832e7f
SHA512 6132224bc761c0eaec6f15f0cc395dc1a05407c4fa8b3181be47fb9a77066a30ef9ee1934321af4742873424ec9c1f3ad402e7ea5bc6a9de29b9d74ff539f07b
SSDEEP 768:7/UxvxjgC+M3my6wOpRUb5fgGM1TnXMqOabMgKK:uZj3+M3HVfgt1TnxOgMgKK
TLSH
T1A713BF36B954AC635CF3D385B20BA292AEF14563D1C92DB889FD6E0E05CB35D430B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 febc21b1356b267e985a44dc1e9d3054551541c0903f3451a5f3f495d6a66d42
MD5 788983a5dc580808d0474b5c72f04585
SHA1 0bed239fb8bea0963017c90ea4548ba88ddc50f5
SHA512 f3bb11ad30c186f0cb5158b944b834c90e053b768c11bc64d3ec72efd16be6fa5dd61541f25370afd92e3a843f4856c90323c81b05eb6f4080ce903d1e9e68a6
SSDEEP 384:WZcIB38NJmoil5PDL2RVDfKAXOVfXZX2FO5h19hgGRSp14gB+EgH18nbpOfErlua:EB3re6wOpRUO5fgGM1TnXMqOabMgMq
TLSH
T190F2AE32B9949C735CF2D3C1B206A2516EF181A7D6C91EA8D9ED7E0E00DB65E030BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 9f1efc9eed96f9e5ad7e893fdfd7ff3e0a6f9ce2a95e5e3a635a60f7d4b56c7a
MD5 dc5ec38faa9781ad82dc8eba0dd4dec3
SHA1 2adb4bec49b08d6fbdbaf5fb42412247b6d4e0d0
SHA512 695dc8653743456ab63d5e6d57416f8beb0d77fe92496a945a1f29db1012234249305c92d2a6f163fe00089d3473f4d0ce387eb72a8684f7f40b0b683a5cc531
SSDEEP 384:fZcIB38NJ7oil5PDL2RVDfKAXOVfXZX2FO5h19hgGRSp14gB+EgH18nbpOfErlua:3B30e6wOpRUO5fgGM1TnXMqOabMgMq
TLSH
T113F2AE32B9949C735CF2C3C5B206A2516EF181A7D6C91EA8D9ED7E0E00DB65E430BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 61be1aa65a310bdc873aa9eb8aa2477552f428e84eb1b242c5f0e57a3bf203d4
MD5 40db76bb08aa6f311e99c2fc805c5746
SHA1 675ba4d102dcb81c8c5481b0a79e9353fbd9751b
SHA512 8a93398eb2317cd8b29c419f2fbb019a14ec2d23e5523966e71ab95f2e25dcf3db79244b7809c4cd754c7b59aeb9bc058bff94d6131afe954720c3c1ffdf9944
SSDEEP 768:FFQ7c3wwgOe6wOpRQ5fgGM1TnXMqOabMgMq:k7c3kfgt1TnxOgMgMq
TLSH
T1D9F2AF73A984D8779CF7C7C5F60A62516EF181A7C5C95DA4D6ED6E0E009B29D030BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 7b3e4d20744a04d17ee60c399aa6c8d369c95ff60725e4e31830cbf694334425
MD5 b26277c77edd7ccf74adefc1a47e3ad7
SHA1 00ed94f7447b1c2ad2492bf29734f9b7f576889f
SHA512 7ee4c9e0aac3c89981c47f34823c06e9d4f80acf2a52e9e1029df7c66ca28cae0516b649aa7df1416ca0595a7569c30a929b8d60e7d51b10def55798e4e8b973
SSDEEP 768:5/UxvxjgC+93CBwOpIu5fgGM1TnXMqOeUAaP8:sZj3+93Tcfgt1TnxO3AG8
TLSH
T1EA03B036AC556C778CF2D384B30AA296AEF544A3D6C51EA889EC3E0E05DB35D530BC53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b24219ff-15c7-4148-b750-36611845dfa1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b24219ff-15c7-4148-b750-36611845dfa1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download