cd99f8aefb83681f7489abd5e7a3d3aa77589b6f59c89984ed9033c9ebd7f15e

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hm.html
Size 2KB
Sample261002-w487csfg69
SHA256 cd99f8aefb83681f7489abd5e7a3d3aa77589b6f59c89984ed9033c9ebd7f15e
MD5 56c4e4db61eda1e5a09cc9593992f7d6
SHA1 91c0bd8a7cd527790897a5f231a154a5940f1e6c
SHA512 85f6e86fe98488544cac724bda4a9bf42bc643951a4a7bbe5d8031d06d24c7ec6a060844f1343b0361b8d81b4fb863b455327464cd3851c054b99c2c854ae912
TLSH
T13F51416B29A320066E67A1A02BFE571027B4A403D507CC653F9D215CCF856DAE7D3798
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
43	raw.githubusercontent.com
41	raw.githubusercontent.com
42	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1804	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{CD15544F-23BD-4E41-9276-44ED7DADE5D0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 544	1120	msedge.exe	85
PID 1120 wrote to memory of 1804	1120	msedge.exe	86
PID 1120 wrote to memory of 4724	1120	msedge.exe	87
PID 1120 wrote to memory of 2180	1120	msedge.exe	88
PID 1120 wrote to memory of 4724	1120	msedge.exe	87
PID 1120 wrote to memory of 4724	1120	msedge.exe	87
PID 1120 wrote to memory of 2180	1120	msedge.exe	88
PID 1120 wrote to memory of 4848	1120	msedge.exe	89
PID 1120 wrote to memory of 4848	1120	msedge.exe	89
PID 1120 wrote to memory of 4848	1120	msedge.exe	89
PID 1120 wrote to memory of 3096	1120	msedge.exe	90
PID 1120 wrote to memory of 3096	1120	msedge.exe	90
PID 1120 wrote to memory of 3096	1120	msedge.exe	90
PID 1120 wrote to memory of 2356	1120	msedge.exe	92
PID 1120 wrote to memory of 2356	1120	msedge.exe	92
PID 1120 wrote to memory of 2356	1120	msedge.exe	92
PID 1120 wrote to memory of 3656	1120	msedge.exe	93
PID 1120 wrote to memory of 3656	1120	msedge.exe	93
PID 1120 wrote to memory of 3656	1120	msedge.exe	93
PID 1120 wrote to memory of 624	1120	msedge.exe	98
PID 1120 wrote to memory of 1248	1120	msedge.exe	99
PID 1120 wrote to memory of 624	1120	msedge.exe	98
PID 1120 wrote to memory of 1248	1120	msedge.exe	99
PID 1120 wrote to memory of 4188	1120	msedge.exe	101
PID 1120 wrote to memory of 1996	1120	msedge.exe	102
PID 1120 wrote to memory of 1996	1120	msedge.exe	102
PID 1120 wrote to memory of 1996	1120	msedge.exe	102
PID 1120 wrote to memory of 2596	1120	msedge.exe	104
PID 1120 wrote to memory of 3696	1120	msedge.exe	105
PID 1120 wrote to memory of 2596	1120	msedge.exe	104
PID 1120 wrote to memory of 3696	1120	msedge.exe	105
PID 1120 wrote to memory of 3696	1120	msedge.exe	105
PID 1120 wrote to memory of 5008	1120	msedge.exe	109
PID 1120 wrote to memory of 4356	1120	msedge.exe	116
PID 1120 wrote to memory of 1256	1120	msedge.exe	117
PID 1120 wrote to memory of 1440	1120	msedge.exe	118
PID 1120 wrote to memory of 2332	1120	msedge.exe	125
PID 1120 wrote to memory of 2332	1120	msedge.exe	125
PID 1120 wrote to memory of 3048	1120	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\hm.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ff86466c188,0x7ff86466c194,0x7ff86466c1a0
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,3934334625050791390,2100529476216879815,524288 --field-trial-handle=2516,i,4539848325371848680,12772681074949570866,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,16819735784035346835,13120426123861815742,262144 --field-trial-handle=2516,i,4539848325371848680,12772681074949570866,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,4915422198871462176,9853048775530241913,524288 --field-trial-handle=2516,i,4539848325371848680,12772681074949570866,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,14713009584716779923,862549399922570883,2097152 --field-trial-handle=2516,i,4539848325371848680,12772681074949570866,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,16614792310261809297,15760534821470386091,2097152 --field-trial-handle=2516,i,4539848325371848680,12772681074949570866,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,15062937686900195335,17296123001399799222,2097152 --field-trial-handle=2516,i,4539848325371848680,12772681074949570866,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,17410072944844998868,8695266454258008717,2097152 --field-trial-handle=2516,i,4539848325371848680,12772681074949570866,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,17478188487469220845,2960048617092712581,524288 --field-trial-handle=2516,i,4539848325371848680,12772681074949570866,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,16014680068023341018,13193323830025567663,524288 --field-trial-handle=2516,i,4539848325371848680,12772681074949570866,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,4020875525827426481,9110967608100287905,524288 --field-trial-handle=2516,i,4539848325371848680,12772681074949570866,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,4020875525827426481,9110967608100287905,524288 --field-trial-handle=2516,i,4539848325371848680,12772681074949570866,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6212,i,10909098061323520240,13854984207937784614,2097152 --field-trial-handle=2516,i,4539848325371848680,12772681074949570866,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,7173963239781085041,11721781664148926573,524288 --field-trial-handle=2516,i,4539848325371848680,12772681074949570866,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6432,i,1009399416773739443,4320221399926175421,2097152 --field-trial-handle=2516,i,4539848325371848680,12772681074949570866,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,2580245256658792310,9812050988917524131,524288 --field-trial-handle=2516,i,4539848325371848680,12772681074949570866,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4172,i,5122303842126199853,8456825599859041298,524288 --field-trial-handle=2516,i,4539848325371848680,12772681074949570866,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4220,i,18185308973797171860,11396226202096977287,524288 --field-trial-handle=2516,i,4539848325371848680,12772681074949570866,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,8311427481140285603,3257597868749632224,524288 --field-trial-handle=2516,i,4539848325371848680,12772681074949570866,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:8
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,15473141514639398615,1034045033864103906,524288 --field-trial-handle=2516,i,4539848325371848680,12772681074949570866,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6724,i,15527447546743718168,9767542063245775116,262144 --field-trial-handle=2516,i,4539848325371848680,12772681074949570866,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

31f0c86c-e0ae-43d3-8403-dbec42971f39.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\31f0c86c-e0ae-43d3-8403-dbec42971f39.tmp
Size 21KB
SHA256 ddcd54fb14b70c1fa9735c9af54cc261b9893f2af713efb67cad9e3652aa7b2d
MD5 de86861a68f0c41c3870203ef738c85a
SHA1 16b7b0b002bfadbfdebd0fec86767b7bfc0cc45b
SHA512 f9c4b7914be364ade3657756003baeed8dbf7393862645776d000394a229491209c62a3568201afb5729f440db352a2ad5d6ee6cb5f04b17fabd7c8ab5f3ecf7
SSDEEP 384:viFiZcIyzsNz8TUNTUlIlAvjHcEp5u8iI8AYol+EVZh6DKhHRXoW:6FQa2wgOIukI59ZfYGHRXl
TLSH
T17FA26D335CA8987AADFA9E42FA4B36038FF54267D685AB94D5CC9A1D00DB1DC1307E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6d65bbd7-6460-4fb2-9413-33bf3631973f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6d65bbd7-6460-4fb2-9413-33bf3631973f.tmp
Size 18KB
SHA256 8cd3dd53a54c01746cef8fb7b8a41ea1b2eacd073a2f0cdbcc981f1199e3a01e
MD5 919a7064ff3eb6b1a71210632d080ce2
SHA1 bcf47133660c2469738ced1564f881058e7c3b52
SHA512 ec93f1b77b9eaba586fa6f99cb462d99948a6eda97f98ee5abd027d50485b38a5e713ea7f4f7473bb9f0fa3d6a97fd9e2984860deb4e9a3c21423358108eff35
SSDEEP 384:QZcIhsNhAvjHcEp5u8iI8AYoO+EVZh6DKhHRXoW:uhRIukI5WZfYGHRXl
TLSH
T1BF827D365C786C7A6CFAE952F54B37039FB48257D7C96B8484DC9B1D00DB2981307A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

902eaede-0905-4932-be6a-9fea9d09d941.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\902eaede-0905-4932-be6a-9fea9d09d941.tmp
Size 8KB
SHA256 4347edae51371f961f555c8c81979ec899f31fb57d23aea3a1f7f2c17987979e
MD5 29ece111da55e12175cedd606ba50fad
SHA1 ffe2dce4827759c22ed6864e0c33e961961864e3
SHA512 05182dce9569172d8aa6a11536cf94581d1e65b2925fefc89d4064e67acf1ef8b2253cab2f959093a6c0ad4b753db85a963be87f2d35dac36a1f93b6adb57cc5
SSDEEP 192:SONc6iD8QmiUy5uEq5u88PINuAPwohuZdqTEU6:SONc6t3Eq5u8iI8AYoY+EU6
TLSH
T104120B3568B87C6B6DD3A855F58736078EA5431BEB897BC4D9EC161C04EF29C1307613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

09954638-8c22-4b9a-85c5-0def30ee7639.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\09954638-8c22-4b9a-85c5-0def30ee7639.tmp
Size 10KB
SHA256 483b9975ff326799aa604f16cb18c54f0c0b01dd497437d90145f5db8e2e16a7
MD5 636c3313b5f17b324cdaa22da1320fa0
SHA1 fd44d97a6747b70339b7394b37641e21ed460bf8
SHA512 7c2b50ec6d98b112b60237b156b9353a5bbb5856494b9e2069334b52f1f35f8a6bbd78b707af2d5034365220f06d2415bfbef430fa5e832abb9a7525cac251c2
SSDEEP 192:sxZeR+nM/fZsI8F9IdpH/HW6+WNGYaIVeIg5wJ:sxZeeM/fZsI8F+fHbGhe
TLSH
T12F22D8516E68A97B8CCBE20DBB55BF53E7F9503251D01E48A6FC861C05E6ACE130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45a999a0-783a-43ab-9803-6a0df1a0d35c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\45a999a0-783a-43ab-9803-6a0df1a0d35c.tmp
Size 10KB
SHA256 865aed10f137ab41c839db6ca4c2efef6fc87170615f6e432c73ffeb746bde36
MD5 fec29c097bb2e9ea09cd79839f4e298d
SHA1 885994b332f77542ed6947aaa371698395d86bb9
SHA512 1e5bec587f60ef1a5f49b04d8e18aabf45111e33917e975c44e440668bb8de7da182fcae0f6081fa87930b0e96f586463e6768a0a59cdd0522f01aa9add407e3
SSDEEP 192:sxZeR+nM/fZsI8F9Idpd/HW6+WNGYanVeIg5wJ:sxZeeM/fZsI8F+lHbGUe
TLSH
T11222D7516E28A97B8CCBE20DBB557F53E7F9513251901E58A6FC861C05E6ACE230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d3830a5-d638-4457-a1e6-d1ac88649611.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4d3830a5-d638-4457-a1e6-d1ac88649611.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

638c06ea-f4b9-45c6-bc46-2254c0210aba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\638c06ea-f4b9-45c6-bc46-2254c0210aba.tmp
Size 9KB
SHA256 033b3ccecd69dee259f0b30e250c668f212aa6b26c4722711b83f7ff154424e4
MD5 4a0c5615d7c54289494f99c20ffe8b52
SHA1 a05905d3cf7a31369e575c9f7233aa1e6605d494
SHA512 54f05162bff17d80763e1e159e5913037a3f81f40421d9d43da14ce0c9a2e76be7c3fb9f087ef2ebea1bddb67101057360bed84aa6ec89262cefe41d932db57e
SSDEEP 192:sxZeR+nM/fZsITF9Idpd/HW6+WNGYaQVeIg5aJ:sxZeeM/fZsITF+lHbGJ0
TLSH
T13722D8516E28B57B8CCBD20DBB55BF53E6F9513291D01E58A6FC861C04EAACE130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75111352-87de-4438-b327-8678cd5ac0ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\75111352-87de-4438-b327-8678cd5ac0ad.tmp
Size 9KB
SHA256 7f247087d576940e0e71eeec0be6f9c8ff888a62376449de9a1f582586aea649
MD5 90740b8d00c966b02256d787f80bf629
SHA1 9428a0ce82b6200d45556aa1731a3998262e998f
SHA512 bdef9c8a4e6ea0e3416be58a94b93ca57f52f50f417fad4dda0f3f1aeebecb4e2cf99bf0571679672b54a0d224b5b3e0ad039edb1eeaba63b6978c6d08fdd6ec
SSDEEP 192:sxZeR+nM/fZsgTF9Idpd/HW6+WNGYaQVeIgrJ:sxZeeM/fZsgTF+lHbGJ9
TLSH
T1AF22B7516E28B57B8CCBE20DBB65BF53E6F9503291D41E58A6FC861C04E6ADE130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 bc817c5637f03a51fa34c5a10944df363524a084f22080050c1506ff5bab8690
MD5 9f7fd5ead04f8fbc1b9e9daf5fa14129
SHA1 0b2789ed5ac004d89dc45f7c7c226bc78e6ceff4
SHA512 f346feb1dc789f585e70fe107dffecd42753ed09b3366549e7ff8a3c66e4f7002bc2b96feb7a4953db0bcdb5e503fc785742cf15902443db9364268f9de4ff23
TLSH
T1DF6193A954B00471DB986132B2F4A0873676F0B55FA3EE7200DCC8BFBF4A7599387220
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 845c418fb863b302d860aef9f353d4b9f80505a1b8752f6edcbe7c5ca2ef516d
MD5 385b2a8c3ed01c19d3df5b6f68ca1527
SHA1 0ce89e6be9dcb3b42011c27c6eaf549a7c34956e
SHA512 caf6f2772e0c9fbada7c4b54f97a5f0ce786331f2974177994cb01e3d79c1d425ee8c218aeff590ac5580a5c0b7480e4b61c621d497abb272f57a21a2fc036dc
TLSH
T1CC6194A954A00071DB986132B2F0A1873675F0B55FA3EE7200DCC8BFBF4A7599387220
MD5 SHA1 SHA512 TLSH

Submit Download

b4152e39-19a5-4762-a85d-e7d5d2487916.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\b4152e39-19a5-4762-a85d-e7d5d2487916.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

13a01769-1afe-4d84-b75d-5cb8ea203ed1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\13a01769-1afe-4d84-b75d-5cb8ea203ed1.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

228f2354-f3f4-42cd-b2f7-df31a8df64bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\228f2354-f3f4-42cd-b2f7-df31a8df64bb.tmp
Size 1KB
SHA256 881d15daf5e4ac2021f088cf16dbc352cab610cc61e41804e14db03a565c7f64
MD5 4ebef4599ee61b6ff0f50f2fd04ea196
SHA1 0f25e2707c00370289d33ffe7f7f35fafc406009
SHA512 bd12e9f56ad1536a90d9f3b5bb8377946cd20bb1d083ba85e9927c826cf60f660e1f88f981e8c280b5f55efec55177de395465ccee848f948457eefefeabd2ea
TLSH
T1C7219DF387E1956E8A015AF09A14AE1BCE2C0515832C7C2985D4FF67C3E3476E10265F
MD5 SHA1 SHA512 TLSH

Submit Download

7fb16311-f85e-42ad-a56a-eb32f1072ffd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7fb16311-f85e-42ad-a56a-eb32f1072ffd.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

a92ba118-dba8-4fcb-9136-4e66d1ed34aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a92ba118-dba8-4fcb-9136-4e66d1ed34aa.tmp
Size 27KB
SHA256 6f00793d5c6f373c4b27af8a227f0bfbc4018b89b82cc866d4265a6cc52eef45
MD5 c8c6f49026b50817c41cb32ac5a7d445
SHA1 983429ed8013a67b623b49b2137420b1ea4e2d9e
SHA512 fba84213e7c011b01c366123439dd912866d1c07c43137ca7726a010e2e300b7cc02c2e1a3fbd9c2ae847b99025389184c1e5dac1441f1c048a287f828053d10
SSDEEP 768:rUyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3groRZj9:rUyQRbrWvvlpZu1jaXKLf33rRZj9
TLSH
T1EFC2E92B640CCB7E4FC01E9DDC6A6F976EA802C766588D4047FA984C02C77EE512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

a715862e-49e4-42a6-b77b-3baa53bafdc9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a715862e-49e4-42a6-b77b-3baa53bafdc9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a5b86a3a-ae3e-4bfc-9d5f-63e8e5f095df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a5b86a3a-ae3e-4bfc-9d5f-63e8e5f095df.tmp
Size 18KB
SHA256 bdb87092a657dbc95b4d147c504b30b821e37c856867f8080de9ca0ec7e12001
MD5 228b0b142b106baf0ef385223ed8c891
SHA1 6f11585dee935070d51dba4ad0d897c35134c58c
SHA512 c42163875d8f37cd41fd63c884b2d58ee09603bf8a0abc9ae1a8fb8a0e95f4bc0241fb39afe2b8aa90a55227e78f8fc124a22af0f20f15993c2087ebef5e9c2b
SSDEEP 384:TZcIhsNh7vjHcEp5u8iI8AYoO+EVZh6DKhHRXoW:Lh0IukI5WZfYGHRXl
TLSH
T1D3827D365C786C7A6CFAE552F54B37035FB48257D7C96B8484DCAB1D00DB2A81307A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a9f250c2-9cad-4f9b-aea2-685eb730e297.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a9f250c2-9cad-4f9b-aea2-685eb730e297.tmp
Size 8KB
SHA256 89359aa153459dafd76ca756f820ea5f291c37be6aeb7bd7648efb3937501755
MD5 d4f61fa41eb82502112d452a5c9101c6
SHA1 32096fa79a543d028124772b1e5b8188f0c9efee
SHA512 7e013107914a212c9fb854e472711c60f5b67543154591231b1a687f1d6e473f51e53c0d5fa59dfd88e9b5671d99a361c61c28fadde86f780c1c1b3a5ad995dd
SSDEEP 96:PqONk/QsjpfwDISp5ih/cIPURHl8h4otop5nmDOBfPGxvw45RxmJm78lFDxv+NjV:SONX6iDCQmiUyAuHq5u88PINhSql1bU6
TLSH
T15F020838AC787CABAEF3AD15B5473B179FA4112FE6952F84D9E81A1C00D729C1307523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d8b673a1bff3413e72ac5d1de1314682590ca51e767fd46ca92536041d1a8b97
MD5 754e5662fddca89c208a622a913cc3f8
SHA1 6ef1a95004b9599a77cdc87828c042e3820f4ac1
SHA512 cb8be8f04ca91ec6a5e46832f6462d5aede36c57a88f885742ab3e3dec0a4573222571b93ef88d09feba1cae4effb668e6972c123139f850026e78e59399a353
TLSH
T15E412C58BAE91158B3B36F1AABF6A96D54BFB8772F06C45D10010E4F0662B00C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

b8f90336-c6ee-44f1-8fe4-b635aa57cc28.tmp

Path C:\Users\Admin\Downloads\b8f90336-c6ee-44f1-8fe4-b635aa57cc28.tmp
Size 6KB
SHA256 c290a1eeba74b1d36048a2d227be5528ebd428fbd5e968e230bbab806cc12c81
MD5 f07c1707255335409c00a56a2e65c601
SHA1 f2c349d1c7127ee1ba7d433febd887a392c6501a
SHA512 4139e437ac821318b6bc00c94ed81b48dd146f2e219908baf6f590279c8b399c663924dcebc09164a561339a24adf424ec6ceabdf883cb5b3803e54d6e17c89c
SSDEEP 3:YmsdlbafFl3ldSaR19n+v//sa6T8Jl+R7E/3/27cllzWll8lO/5lMx/6v4llH2l4:J1b9n8X76E+xkuQ/i0Q/QyQ/WIA/Ul
TLSH
T169D18C60B6A1C7B7D3C3583A9A86E2048225BD40CF020283B05CB38F2678BD94348809
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download