f3d80f805f999f72f4368718b391fc9fd15e910c64d4d4e5dd240a2d8538e35f

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 06:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 260KB
Sample261002-g72jcssdnb
SHA256 f3d80f805f999f72f4368718b391fc9fd15e910c64d4d4e5dd240a2d8538e35f
MD5 c89ab3aa08480051649cdf868ceab22b
SHA1 3b7b1631fa24ae95f77833bb4f3de48ebb4ec5fb
SHA512 8f70418ab85630136f99f3025cb511a3a4805e9f22214e85de8844aba3b76134543c3ac167307357b7d1d0d0defd159290de2c9f1b54859bf0a8180ecce2e3d0
SSDEEP 6144:Lt1DkYheITkSBfIZ23qv5zD5cOudTrpiTZQdUV+iLyRkX3Ihc1Mu+E:3e6BOWdgCzul
TLSH
T12C44C0398936BCC4834C3B0097642C6B21ED5959A3F78E2CD5192CFA7EB2B55EF618C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
124	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{EBAD7861-DDBF-42B6-83F5-8C009CD6A149}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2560	msedge.exe
2560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 1228	4656	msedge.exe	89
PID 4656 wrote to memory of 1512	4656	msedge.exe	91
PID 4656 wrote to memory of 124	4656	msedge.exe	90
PID 4656 wrote to memory of 1512	4656	msedge.exe	91
PID 4656 wrote to memory of 1512	4656	msedge.exe	91
PID 4656 wrote to memory of 5020	4656	msedge.exe	92
PID 4656 wrote to memory of 5020	4656	msedge.exe	92
PID 4656 wrote to memory of 2292	4656	msedge.exe	94
PID 4656 wrote to memory of 4672	4656	msedge.exe	93
PID 4656 wrote to memory of 2292	4656	msedge.exe	94
PID 4656 wrote to memory of 2292	4656	msedge.exe	94
PID 4656 wrote to memory of 4672	4656	msedge.exe	93
PID 4656 wrote to memory of 4672	4656	msedge.exe	93
PID 4656 wrote to memory of 1108	4656	msedge.exe	96
PID 4656 wrote to memory of 2788	4656	msedge.exe	97
PID 4656 wrote to memory of 1108	4656	msedge.exe	96
PID 4656 wrote to memory of 1108	4656	msedge.exe	96
PID 4656 wrote to memory of 2788	4656	msedge.exe	97
PID 4656 wrote to memory of 2788	4656	msedge.exe	97
PID 4656 wrote to memory of 4260	4656	msedge.exe	98
PID 4656 wrote to memory of 4260	4656	msedge.exe	98
PID 4656 wrote to memory of 4260	4656	msedge.exe	98
PID 4656 wrote to memory of 1924	4656	msedge.exe	99
PID 4656 wrote to memory of 4420	4656	msedge.exe	100
PID 4656 wrote to memory of 1924	4656	msedge.exe	99
PID 4656 wrote to memory of 4420	4656	msedge.exe	100
PID 4656 wrote to memory of 4420	4656	msedge.exe	100
PID 4656 wrote to memory of 5012	4656	msedge.exe	101
PID 4656 wrote to memory of 4660	4656	msedge.exe	103
PID 4656 wrote to memory of 948	4656	msedge.exe	104
PID 4656 wrote to memory of 4660	4656	msedge.exe	103
PID 4656 wrote to memory of 948	4656	msedge.exe	104
PID 4656 wrote to memory of 3952	4656	msedge.exe	106
PID 4656 wrote to memory of 3820	4656	msedge.exe	110
PID 4656 wrote to memory of 4604	4656	msedge.exe	111
PID 4656 wrote to memory of 3780	4656	msedge.exe	112
PID 4656 wrote to memory of 5684	4656	msedge.exe	113
PID 4656 wrote to memory of 5684	4656	msedge.exe	113
PID 4656 wrote to memory of 2560	4656	msedge.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff879b3c188,0x7ff879b3c194,0x7ff879b3c1a0
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,18138745524952940924,17543625802551975478,524288 --field-trial-handle=2728,i,7087824113168764346,16977653278385581944,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:11
  2⤵
  - System Time Discovery
  PID:124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,2323251840594933325,10232666304751151121,262144 --field-trial-handle=2728,i,7087824113168764346,16977653278385581944,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:2
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,6693907820961099993,7169095311873520714,524288 --field-trial-handle=2728,i,7087824113168764346,16977653278385581944,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:13
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,12621391069932651952,2309286771332932293,2097152 --field-trial-handle=2728,i,7087824113168764346,16977653278385581944,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,17708967561876233759,16063569721694915551,2097152 --field-trial-handle=2728,i,7087824113168764346,16977653278385581944,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,4463049582277834580,161309884684611923,2097152 --field-trial-handle=2728,i,7087824113168764346,16977653278385581944,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,7675549356768344189,9879134149353183212,2097152 --field-trial-handle=2728,i,7087824113168764346,16977653278385581944,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:9
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5464,i,16974850254727096756,8608608371889634714,2097152 --field-trial-handle=2728,i,7087824113168764346,16977653278385581944,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,14213171459899260260,9275268288657964672,524288 --field-trial-handle=2728,i,7087824113168764346,16977653278385581944,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5716,i,9324627615997296467,16583474480943836261,2097152 --field-trial-handle=2728,i,7087824113168764346,16977653278385581944,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,4347115367434180626,3607616604428437952,524288 --field-trial-handle=2728,i,7087824113168764346,16977653278385581944,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,11900217844140395054,7116618213241058451,524288 --field-trial-handle=2728,i,7087824113168764346,16977653278385581944,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,9066202041054695733,6031416243737840416,524288 --field-trial-handle=2728,i,7087824113168764346,16977653278385581944,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,16830036308869274744,5802867815295605280,524288 --field-trial-handle=2728,i,7087824113168764346,16977653278385581944,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:14
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,16830036308869274744,5802867815295605280,524288 --field-trial-handle=2728,i,7087824113168764346,16977653278385581944,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:14
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7200,i,12857075905057719281,17035088317679576342,524288 --field-trial-handle=2728,i,7087824113168764346,16977653278385581944,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:14
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7340,i,6391112731820738613,10866544544012248537,524288 --field-trial-handle=2728,i,7087824113168764346,16977653278385581944,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:14
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7496,i,6309241223478874995,11862903875745130887,524288 --field-trial-handle=2728,i,7087824113168764346,16977653278385581944,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:14
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,12259543293859296579,11997599038591824059,524288 --field-trial-handle=2728,i,7087824113168764346,16977653278385581944,262144 --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:14
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5896,i,9685755938867818244,13356690380410245317,262144 --field-trial-handle=2728,i,7087824113168764346,16977653278385581944,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

80b1e257-aecc-48a9-8d0e-6d77f3d5d853.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\80b1e257-aecc-48a9-8d0e-6d77f3d5d853.tmp
Size 37KB
SHA256 8526f426d8bda3479b7ec0bc1496932cd61e37731b337783d0f7be0536493edb
MD5 eca262bec3696a221e3a963c618eb83f
SHA1 663cf0a82f86523c58ce149e8db5280d3eb5d944
SHA512 72a7c976c3a363f64a3f780d349965ae7f303a494fc21e43b23707addd4c7b04dc465fd4b91e40d8201b96b5642e759664e15bc997a39945c197110cbf9b7042
SSDEEP 768:R/UxvxjgC+W3oFec7fZrKt5p5XSwQs88uBkiTCwY/P84g:kZj3+W3oPtrIILNBbYHg
TLSH
T19F03D039E8945873ACF39385375B370BAFF06053C4C41AA849EE7A1E029B35D630B897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a140e4c-1858-4032-808d-9da04ab531bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8a140e4c-1858-4032-808d-9da04ab531bb.tmp
Size 36KB
SHA256 c72d3cf9043c95d41faec45a509897f3ecc6b039fec389778f83aca1eaa8b251
MD5 60d21b65f56a336cc994c7a53773b4fa
SHA1 a5437711b77b6ca3b1651e3a7f0905327f8c2109
SHA512 f5c1dfc0ea2e442f06f09f56f7d79d899b720f86f90f4701152dc29b44b6bc25f959a25c215557ea95080dfe9e8b3d44df3388f48a6c3249c2f9f85917814a7a
SSDEEP 768:YFCp3mwgPmIc7fZrKtquHAfp5XSwQs88uBkiT2a4YGH2/L:np34Ktr3ughILNBX4YUiL
TLSH
T189F2BF32DCD484B7ACB6D7C6BA5A3706AFF05143C4C81694C6CDA91E019B69D230BCA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

0aa12907-8d63-4006-bacc-337334fa5a70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0aa12907-8d63-4006-bacc-337334fa5a70.tmp
Size 11KB
SHA256 8fdcfedc82e7d3be498971e36845c24ea81440e3d15f70c544a82e7fc84e5408
MD5 88818f5efac4977c89a560e81e1890d7
SHA1 ebaddd7262e21addca7ba8420eb905b184b8df81
SHA512 f74f56fb725182e051824639d68d7ebf0ba7d3f2d13b3b881cd1b60526facd03fd9277171a0085f42ca6f63321341f9350a8933e0d2aedf6379d9e437a084347
SSDEEP 192:sxRYRsOP/fHs8HREjzoA8p67hr/g6+WNIYEHyGPIgDlJ:sxRYFP/fHs81U/5IBj
TLSH
T13542C715AE38A97B8CCBD21DFB55BF53E6F91032A0901E48B6FC8A2C04E76DD520744B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

124707b8-d62d-4204-a439-aa452d654ae4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\124707b8-d62d-4204-a439-aa452d654ae4.tmp
Size 23KB
SHA256 9e7d1aac080694205ab11e2a1f140cbc187673e9c3ad07b62b889f6385286541
MD5 bac002b2c461d4c12cd9f8c90f04e82a
SHA1 fa1b937ea2ce08194f9d0565899a4a16d3e6e0a6
SHA512 f3a100d9f3df943be368c10692eb464542da04aefd9174f5bcf9e087369ff8cd377f8c72d8ba80efd3916c944ecbb87bba4dea4cecc57260377bc8c9f3bb8806
SSDEEP 384:USupCD0fCtg82FfrLKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVQc9hnRXYroJeV:U/pCDmWg8KfrL8F1+UoAYDCx9Tuqh0V9
TLSH
T1F4B2D92B600CCB7F4FC04A9EA8197FD77D9802C79A588D4047FE995C02C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 cb5d77da4409b497194bf44abcbf1660cf6c7a3347b17dbdad308308850c7967
MD5 7b282250e8edff364e2d44bf9ce8fca5
SHA1 5f053b9e902f342344745b06f23174fad103cbe3
SHA512 89150362b6ccdc7717dfa9d0461a84ad07b96c231337796319198b7f3d7f04afe5e764b0e9af47649ac88410ed134115d083fab833318a7f7a16c8d43405abec
SSDEEP 96:ViMzeAW1gyGDOtQumNDamAPmhuveck4+EM:ViMaAAgyGDamND/Yh1+p
TLSH
T1ED81604198D25C96CBF47D700DEB9B8BBBA0E2B22587DE020874CD2D7F86699130818E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c3bd9e7f99f71e480c9fa4ccabd823ce069ba7f428b9fafa03a1e39b150d66bc
MD5 083106941ec707d604e91e6637d66fc6
SHA1 41bdb820b5e19065a5d99829f1e4d2f673405189
SHA512 f0786c678a5413ebc8959da33c08cb97ed5a37c1a03035ca76fe0a1b686781ea9d4bbd5a15876c9cca500cc57f3752e5b62a1170944fb130f28fc9de8ac8ea60
TLSH
T14E514C8169E348E5C7F870754ADF97CBB9B0C5B389876E421DB4C9BD6B4A35153090CC
MD5 SHA1 SHA512 TLSH

Submit Download

bf4947aa-275d-4952-8573-e9d1c71f6b7b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\bf4947aa-275d-4952-8573-e9d1c71f6b7b.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

b82d0987-b2c5-4aa9-987b-d8b9ee413cdf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b82d0987-b2c5-4aa9-987b-d8b9ee413cdf.tmp
Size 4KB
SHA256 c8aba3ebbb93b784bbdb137765d334e2463ccc963ad97bae9e7db0210c7f7327
MD5 3498214a351121fa90ed1fe49da6223c
SHA1 aac90a8cbd0c7fffcc94772c98fe2483754a345d
SHA512 4d17b13d43a3b4a9980db8e568506b9a00ac3ec3cd591564f7779e3293c65a8343b58626018d6dafe6e15cb6599cb83ba51fe6de3b1adfe87d3d9c1aa07bc727
SSDEEP 96:D9mnu0kVf0iejh0ez5YiPBbMGBK7rUNBMBbABed3wZx:DMuv0iejh0e1Yi5bMeK7rUL4b0M3ox
TLSH
T1F3919DF783F4856ECE1196F0AA18AE1FDE2C0615435C3C2689D0AE27D3E3472E10255F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c9be44ae-b18d-4c72-988c-24f1c016a0f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c9be44ae-b18d-4c72-988c-24f1c016a0f9.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

eb3aefda-31ba-45ca-8cc1-3f7a1c9cba25.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\eb3aefda-31ba-45ca-8cc1-3f7a1c9cba25.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

c850a589-bd7e-48ea-aa8c-33782177c966.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c850a589-bd7e-48ea-aa8c-33782177c966.tmp
Size 11KB
SHA256 f4c634f8472a42c1a5a3f44366585c5d83d2ba2f407114911ce3a07616c019be
MD5 ac83f96b99134e59a89abcf196326085
SHA1 94d56a84618208c91d78c628f345d782a4963a8c
SHA512 e79347974c5508ba01f5045a059e9bc72e3c5fcb36541fb7c955805f7aae46426b83912a2f6bd3457e3950001ca4d67eab05435650b38a4e3330bb6be4f9bffc
SSDEEP 192:sxRYRsOP/fHs2HREjzoA8p67hr/g6+WNIYEOyGPIgDrJ:sxRYFP/fHs21U/5Imh
TLSH
T16042C755AE38A97B8CCBE21DBB55BF53E2F9103260911E48B7FC8A1C04E76DD620744B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca4ee115-5096-48b8-88a4-76fbb2d160a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ca4ee115-5096-48b8-88a4-76fbb2d160a7.tmp
Size 11KB
SHA256 c299fafec93be2162e600cd5b220143f62e85173fbbb6f20c78343cd934598eb
MD5 d74548d57f222fe644c2a17c6f7f9beb
SHA1 6ed40b1076a37e32f1e839e0fc18f78d4367b870
SHA512 394b816df5c73b20ffff8708869c718435eae089e89bfb4ad7af64362d392d6c830fa9d2314a1120c5d6d6a65f07f3515342be160377e5b46bc90c87a85ee1b8
SSDEEP 192:sxRXRsOP/fHsAHREjzoA8p67hr/g6+WNIYEIyGPIgIJ:sxRXFP/fHsA1U/5Iws
TLSH
T14E32B615AE28A97B8CCBD21DFB55BF53D6F91032A1911E48F6FC8A2C04E76DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d2852ce7-6707-43a9-bd63-ccca0ed4de24.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d2852ce7-6707-43a9-bd63-ccca0ed4de24.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ee6147b-06f9-470e-b970-c14a5b6a050b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8ee6147b-06f9-470e-b970-c14a5b6a050b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a14af01a-b9f2-4747-a467-599d4619f721.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a14af01a-b9f2-4747-a467-599d4619f721.tmp
Size 33KB
SHA256 b32d527d389822f77dc70d6f400e193876491fd53b9e2da009160a1e1d53c5f7
MD5 152375c5f0df25bfd42c0d3acb65e26c
SHA1 b02b983905a933e92ed3d487ae29187f10b91fe5
SHA512 206b2189625704a004b7c3d151dc49602694353247d9573d8e7f44e9c779bdf2e1b98333a62308cca839560558916f6baf0055a6c6ed2e1ab1a9acd544f75112
SSDEEP 768:f13OmIc7fZrKtquHIp5XSwQs88uBkiT2a4YGH2/L:f13OKtr3uGILNBX4YUiL
TLSH
T124F2BF35ECA498B36CB2D3C6BA563B06AFF0A143D4C80A5485DD761E019B76E270B867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a241dffd-a263-4a9a-b85d-24a5da918af9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a241dffd-a263-4a9a-b85d-24a5da918af9.tmp
Size 38KB
SHA256 64dca37f9c176a93b1a59712104d172bebfa76c5dccb8d920da368fd59ac6dec
MD5 b80aaa08c42e00434a8e864a6320550c
SHA1 e5b344561e5e832661fcd877eb35c6fc777ad2d1
SHA512 550b96039493928d1a1a075722d6c353fa20bac350894fd89c2a145ac01be78d28bb7f75055fd81a335435351c4dd8070096203d89e5b2a082874af30a3f97c1
SSDEEP 768:A/UxvxjgC+I3TIIc7fZrKtquHFp5XSwQs88uBkiT2a/bK:tZj3+I3Twtr3urILNBXDK
TLSH
T1BB03CF39ECA46873ACF293857A4B3707EEF06143C4C41AA849DE6A0E02CF36D574B857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adbcc9a1-51e1-4afa-b949-b08fd298d9ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\adbcc9a1-51e1-4afa-b949-b08fd298d9ed.tmp
Size 33KB
SHA256 953157944a62743cab3d768846d574743f1be6134b83f72ec7aa7965cfd85eb5
MD5 ab9e03c1a92217518837d027cbdc1c5a
SHA1 7bd85928312bcecf09378da32cce34751a784112
SHA512 cc0d86257dab9d074d8cafaae9a4858895eeb4983b8cc305eb3bfff2b710ef7097cc62fa8d673b0a93e22fd4a528d984c4f94d037d705e6d522d3ce944c64f7f
SSDEEP 768:i13DmIc7fZrKtquHIp5XSwQs88uBkiT2a4YGH2/L:i13DKtr3uGILNBX4YUiL
TLSH
T136F2BF35ECA498B36CB2D3C6BA563B06AFF0A143D4C80A5485DD761E019B76E270B867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

43dd201a-6f37-4a03-90fd-327a660c68da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\43dd201a-6f37-4a03-90fd-327a660c68da.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

0f40a476-d776-486d-8bfb-eae880256b3a.tmp

Path C:\Users\Admin\Downloads\0f40a476-d776-486d-8bfb-eae880256b3a.tmp
Size 195KB
SHA256 f5f2aec1b81280914fd14697af1679c7fde50adf12d9182ba4599cef3e2ff528
MD5 bc25cc1af3f1f5d812d3ca2c22e5a422
SHA1 94515cacf4b1396bf3ca00e165e565705b0f87d6
SHA512 1a9cc61b674610a14c5e7819cdb433d116bbe2757dabb18aa32404fba5dc24fc4a76a11c2935c8de8be1dd78d983fda43baa9dcd2b6f702961b069bb06b0072a
SSDEEP 6144:zUlvsAipZ2PPaeMFASid9xeEGv2fduT4kUfmJ:zU1sAipZ2PPaeMFASid9xedv2fduT4kv
TLSH
T131143628A8BF90195573FF823EDCB9EBDCDE6676250DB427108113178B12A80EE1797D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download