3eb238897a04435cfe64cbe152efbd76573528e15c8e1eaecb4163978a391b20

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 18:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 571KB
Sample261002-ww2gjsff45
SHA256 3eb238897a04435cfe64cbe152efbd76573528e15c8e1eaecb4163978a391b20
MD5 063c87203a4d9797877dd369d465aea7
SHA1 f78df2c741d2e47c73f307aeaac349f57d73d964
SHA512 4916319552e371764a80293970998f5846da0baac1a51152c11cd3bd894a0b568ec7f04f2134339c69e350b2d82d40b07c5e39772d24fda6caa5a1ef5839c003
SSDEEP 6144:9IOnKB8BnBVBvByBbBQB6BVFiW3Vi/5OCPXi/5KWPoI:9Boi/Hi/LPv
TLSH
T1C3C43E3065F3607344EBB0E03A616B06FFD1E61BE15A5A4076FD0B969FD2D86AC6B00D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3948	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{6C6CD8D3-666B-4194-B367-5308E1DBC524}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5908	msedge.exe
5908	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 3252	984	msedge.exe	84
PID 984 wrote to memory of 3948	984	msedge.exe	85
PID 984 wrote to memory of 4024	984	msedge.exe	86
PID 984 wrote to memory of 4024	984	msedge.exe	86
PID 984 wrote to memory of 4024	984	msedge.exe	86
PID 984 wrote to memory of 3960	984	msedge.exe	87
PID 984 wrote to memory of 3960	984	msedge.exe	87
PID 984 wrote to memory of 2396	984	msedge.exe	88
PID 984 wrote to memory of 2396	984	msedge.exe	88
PID 984 wrote to memory of 2396	984	msedge.exe	88
PID 984 wrote to memory of 1680	984	msedge.exe	89
PID 984 wrote to memory of 1680	984	msedge.exe	89
PID 984 wrote to memory of 1680	984	msedge.exe	89
PID 984 wrote to memory of 4340	984	msedge.exe	91
PID 984 wrote to memory of 5016	984	msedge.exe	92
PID 984 wrote to memory of 4340	984	msedge.exe	91
PID 984 wrote to memory of 4340	984	msedge.exe	91
PID 984 wrote to memory of 5016	984	msedge.exe	92
PID 984 wrote to memory of 5016	984	msedge.exe	92
PID 984 wrote to memory of 4328	984	msedge.exe	93
PID 984 wrote to memory of 4328	984	msedge.exe	93
PID 984 wrote to memory of 4328	984	msedge.exe	93
PID 984 wrote to memory of 1132	984	msedge.exe	97
PID 984 wrote to memory of 1132	984	msedge.exe	97
PID 984 wrote to memory of 1132	984	msedge.exe	97
PID 984 wrote to memory of 3368	984	msedge.exe	98
PID 984 wrote to memory of 3368	984	msedge.exe	98
PID 984 wrote to memory of 3368	984	msedge.exe	98
PID 984 wrote to memory of 5076	984	msedge.exe	99
PID 984 wrote to memory of 4256	984	msedge.exe	100
PID 984 wrote to memory of 5076	984	msedge.exe	99
PID 984 wrote to memory of 4256	984	msedge.exe	100
PID 984 wrote to memory of 1672	984	msedge.exe	102
PID 984 wrote to memory of 5812	984	msedge.exe	118
PID 984 wrote to memory of 5820	984	msedge.exe	119
PID 984 wrote to memory of 5828	984	msedge.exe	120
PID 984 wrote to memory of 5300	984	msedge.exe	123
PID 984 wrote to memory of 5300	984	msedge.exe	123
PID 984 wrote to memory of 5908	984	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff972c8c188,0x7ff972c8c194,0x7ff972c8c1a0
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,12279706064287069735,9336219084329390869,524288 --field-trial-handle=2832,i,9090433590457304476,12397336065648720047,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1864,i,10872135410056038264,767244842404444320,262144 --field-trial-handle=2832,i,9090433590457304476,12397336065648720047,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:2
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,3442849565429211023,14529849404992131013,524288 --field-trial-handle=2832,i,9090433590457304476,12397336065648720047,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,3665060833122448204,3613490462225849840,2097152 --field-trial-handle=2832,i,9090433590457304476,12397336065648720047,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,7670339714030226136,3210867032710437000,2097152 --field-trial-handle=2832,i,9090433590457304476,12397336065648720047,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,13190723540731970659,6594820972426275705,2097152 --field-trial-handle=2832,i,9090433590457304476,12397336065648720047,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,4895477313414556823,11319122846665811751,2097152 --field-trial-handle=2832,i,9090433590457304476,12397336065648720047,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:2
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5076,i,12503723703445518300,17019713902170981274,2097152 --field-trial-handle=2832,i,9090433590457304476,12397336065648720047,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5288,i,18362640095230904279,9358849723094066240,2097152 --field-trial-handle=2832,i,9090433590457304476,12397336065648720047,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5496,i,11112704243848690278,18386602752586783859,2097152 --field-trial-handle=2832,i,9090433590457304476,12397336065648720047,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,6754485530318877953,14346688073398791434,524288 --field-trial-handle=2832,i,9090433590457304476,12397336065648720047,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,15374421381463659709,13898329064424103383,524288 --field-trial-handle=2832,i,9090433590457304476,12397336065648720047,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,16664859378339147706,16522663158800683916,524288 --field-trial-handle=2832,i,9090433590457304476,12397336065648720047,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,16664859378339147706,16522663158800683916,524288 --field-trial-handle=2832,i,9090433590457304476,12397336065648720047,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,15911107927425773383,17545801202250279720,524288 --field-trial-handle=2832,i,9090433590457304476,12397336065648720047,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,11151798113843379639,8333003213740833603,524288 --field-trial-handle=2832,i,9090433590457304476,12397336065648720047,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,1742877985807406827,5349652180681408395,524288 --field-trial-handle=2832,i,9090433590457304476,12397336065648720047,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,294075465812578944,10643519343246272364,524288 --field-trial-handle=2832,i,9090433590457304476,12397336065648720047,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4504,i,10433398576507719479,9142781831874562449,262144 --field-trial-handle=2832,i,9090433590457304476,12397336065648720047,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6b5d776c-f71b-44e0-ad38-a15451203ffb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6b5d776c-f71b-44e0-ad38-a15451203ffb.tmp
Size 18KB
SHA256 6376635290de993b98eeeb9be8522e9c0200658e195f5ae8ee50c0a24abdfe94
MD5 c813c05458b53054d48840a776395085
SHA1 cede25844ff7e1cffebfbd62afbde3a9778478ca
SHA512 702f63761e3dbfbe47ec17cefcef24bdb094d4f8e7228f48458c7c627c3c025ac7ac4e22d3bb93a6cb7d420d7a31ed16caa824df522a53b76ec5dfc7ca0aea4f
SSDEEP 384:fZcIhsNxVkeDNF+p5u8ipaiNaghtgOIwZOy3Zon:3hxefMkpUghXsok
TLSH
T11D828C32AC785C7A6CEB9552F58B76035FB88167E3C89B84D4EDA72D01EA5D8030B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

969ce352-1e14-4baf-9c09-c3a85c436e12.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\969ce352-1e14-4baf-9c09-c3a85c436e12.tmp
Size 18KB
SHA256 8a9e96a469e32c773798ecdb3e63cb2dadd021c63483730f875dbaa7e0a71ee0
MD5 a7dfe6c3aacfba932af628da1eac164b
SHA1 a0dd7145976e70dc2be6bd034a2c3622a0689b9c
SHA512 f3804c8e56905ef6c63e3b1ba9af01a4cb406619777d5aca0f1f319043d52b90107090632e3b4b02b6d8d071bb46738230c66261b33f370a6812d78ef20cac84
SSDEEP 384:oZcIhsNxykeDNF+p5u8ipaiNaghtgOIwZOy3Zon:Wh0efMkpUghXsok
TLSH
T157828C326C785C7A6CEB9542F58B76135FB8816BE3C89F84D4ED972D01EA9D8030B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

144aadf6-218c-4598-88c0-736772241409.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\144aadf6-218c-4598-88c0-736772241409.tmp
Size 27KB
SHA256 e152313b4ca511852f7c27a7df21477bf1f4abe6d0e85e8d9ccd5aa6897acbb9
MD5 6e218f6083e17f9ce35641dcb45efd40
SHA1 5a3bc1f72d3acf505012f449c63ec5d286038795
SHA512 5eef96d9a5a7670f6bb68e551df168bd110a45a0f1ea0ede91b40d0735d7ad77c9f16ccca5d8189c448ab951e3a20d44aa91b94c8a9cedf30d70f014bb2692e5
SSDEEP 768:huyQRbrWvvlRZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3yro3ZBx:huyQRbrWvvlRZu1jaXKLf33p3ZBx
TLSH
T1E1C2E92B640CCB7E4FC01E9D9C6A6F976EA802C766588D4447FA984C02C77EE512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95562546-ff91-4296-a1d0-078a977950d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\95562546-ff91-4296-a1d0-078a977950d9.tmp
Size 10KB
SHA256 279e2877d9817c4da0860c626a9e9d2b18c98351d18dc6093129de6e4f863d06
MD5 c2d2dbe557c585a183a5b50c3fdbfd07
SHA1 0e7959d8fd394d42e7cc9860e1b7ad7c5629d0dc
SHA512 8228ab258c6ed680f6ea67fb91bd6b5f816bf35514baac9a0b65e73e1f4bdc785aa27beeaaec81b894f15f30f8e416496727b029d2c7f89f9635c55b75f9ede2
SSDEEP 192:sxZvRH7WT/fgs1F2IdpdSHW6+WNGYaqpQIg51J:sxZvkT/fgs1F34HbG5t
TLSH
T15A22B8516E38A57B8CCBE20DBB55BF43E6F9503291911E4CAAFC862C05E7ACD130740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 617c4b838afa8e3a7d763990f097a6b8b072fdebd85c6bd60aacb245a19a519e
MD5 352f63087fee44fc60ad78ad8678325c
SHA1 cc40c1bebda876302fdc643c32cdfe2420f76daf
SHA512 f960f8baf71d8077ce37d70096a7b10c24e6be38567819a66a2f85bb472d2dc65389794628e6191029cd16c3db8cbb38228f2e153c695af6536fc6b2d141a9ad
TLSH
T127716187D64342E9FBA665B091D29DDB3534909384033F3AC9C4CAB5B817729DA1D073
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2d4f0de9f9e13217984d6dd53df8715453b776fd838e875371efa37ce77dc484
MD5 8d04b357aff7f575a3e446e7882b9ba3
SHA1 9b39922459d632b9202cad81ab919c9cf2788318
SHA512 f58ab485500e584a53941c606b9c6491f55fb8ef3c97d8400df21ab6f91409eca4c85c2a9453ceea477863f267017757b1f8676eef2f29fa56b1a52f73021c5c
TLSH
T14C615E83D34346E9F7AA65B095E29DDB3A35909784433F3EC8C8CA75A407726DA1D073
MD5 SHA1 SHA512 TLSH

Submit Download

fca01559-5517-4358-a544-62018006e6b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\fca01559-5517-4358-a544-62018006e6b7.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2d1c42de-979a-4057-b2a2-912b204103e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2d1c42de-979a-4057-b2a2-912b204103e8.tmp
Size 3KB
SHA256 9b4d4ce7c006746f5cf0da164ff8242e14b3a30d30dfe58c33990399ec88ff2e
MD5 b7a67ea50d8130de41e778b058276104
SHA1 bda53065dc80f633c4327389370497dafd979fe5
SHA512 407028f4b1e656a5396124f4bf7f9568db4a9191acebc22d748afc0126ea1a98e1b294df852dc67227d7dea8486729a5b2f88b7a865fa4aae3b879a248d7a614
TLSH
T130817CBBC3D887BE881156F05B25AE1ADD1D055B52283C568DF8AF8F63F2472D10229F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

c62b7f22-6da6-4ac8-9628-ba3c90089373.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c62b7f22-6da6-4ac8-9628-ba3c90089373.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 770bac0793c9f290b8b70119a94ef85f5ba2a4c5012a4be354747a56044c1978
MD5 d21160515cd19a1c393bc21b8677a308
SHA1 93d1b8ce8d610dd55cff02566273afbcb72741a1
SHA512 d6edcf8b40fe40a7be679d352b6aeee9fe84037594724ef7957a7248fcae7d9dc308d985ef61aadce1d4f9025184ddbd670ac492f99fed0a8a0744259f2ebc82
SSDEEP 192:sxZvRH7WT/fgsBF2IdpdSHW6+WNGYaQpQIgrJ:sxZvkT/fgsBF34HbGD9
TLSH
T1D71297516E38A57B8CCBD20DBA25BF53D6F95031A1951E48AAFC862C05E7ADD130740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

bea72668-eaf9-4a3e-8e54-edef76c0e409.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bea72668-eaf9-4a3e-8e54-edef76c0e409.tmp
Size 10KB
SHA256 df4300a01a2fcb90ed5d589b34b7b1f77250ae4ed1caa00a3b5d42b78a625047
MD5 6ece9e5b6b21e4a2758d0328bdf973d9
SHA1 9b1cc4797d1db2fc2206111ac8846433f63ea733
SHA512 050629653f1573cc4a42991fc3891908c67776f972f1fa477ce03ef1507103b941543ec0a006c9f68d07e75b8ab8f90a6b890d436e92cf100267348ab1779be7
SSDEEP 192:sxZvRH7WT/fgs1F2IdpHSHW6+WNGYaqZpQIg51J:sxZvkT/fgs1F3yHbGdt
TLSH
T1A322B8516E38A97B8CCBD21DBB55BF53E6F9503291911E4CAAFC862C05E7ACE130740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da48459f-7aa4-4753-863b-1bff1f7b4a42.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\da48459f-7aa4-4753-863b-1bff1f7b4a42.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6bcbf38-1515-49d2-a513-3c99229ee48f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e6bcbf38-1515-49d2-a513-3c99229ee48f.tmp
Size 9KB
SHA256 00c3f8d4220dbcad2cadbf904119dfcd78d9f551affbf553bf67341fe037b9c4
MD5 53b857ae2e068a4fb86d32edd902f9e2
SHA1 15406b7ddb3e5a9ebfa266e0f7772c8edca84ab3
SHA512 3ee6754f4075a2af62fb73475be0e8fd05bf42772171c7c055e10336ec922d311d6aaa09bd2004b885861883102df54b9b3fbdafc0abdb843c26dc6fc9c2df17
SSDEEP 192:sxZvRH7WT/fgsjF2IdpdSHW6+WNGYaQpQIg5nJ:sxZvkT/fgsjF34HbGDr
TLSH
T10222A651AE38A57B8CCBD21DBB55BF43D6F9503191951E48AAFC862C05E7ACE130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8639a2a7-178c-43ae-b9ae-854fef888bd2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8639a2a7-178c-43ae-b9ae-854fef888bd2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

d4644e7c-76b8-4f6f-9bc2-f9f99d2053bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d4644e7c-76b8-4f6f-9bc2-f9f99d2053bc.tmp
Size 8KB
SHA256 cb0329615441c32cbd56b53dfb9796b5048be90150e1ff08bbedef23271a04b9
MD5 a26722379950461a2927128cffb1056f
SHA1 b7369a4c97acf3b467d4888c2f2e6747017d98f8
SHA512 4ecdf5c6a10a667d040d87a0752f2de78b51780130e6638ed1f71f4a26de69bfd6b16684072ca99735d9b7ff7f0d46d235745eac64d044bb81d042af548765d2
SSDEEP 192:SONc6iDdQmiUyEu6q5u88PpPCi3da8uZVqGlU6:SONc6WG6q5u8ipaiNaDhU6
TLSH
T17A124A36A878AC7BADD39961F04776139FA4422BE7886F84D9DC262C02EF5DC1307913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e879807a-d32d-4ef5-a9ed-e4e43b416b89.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e879807a-d32d-4ef5-a9ed-e4e43b416b89.tmp
Size 8KB
SHA256 e94d134ca1d06684411f8bb59971b2a7d74ecd077a63cbfaacdfba5f77055471
MD5 a01e914d2d32ae5c5bbc9c33289cdf77
SHA1 a75a779f9caffb1c9a5eb98e746589e22c642aca
SHA512 a11335836dd29727b8b4dc3e5737da75758c3f8a7199d34c704fa30556c0587e95c399b3c01c4efb8684ad458f0526dae76be7043be4483b77ba61d1c4199450
SSDEEP 192:SONH6iDCQmiUyeuHq5u88PpPCPSqTicU6:SONH6/OHq5u8ipaNDU6
TLSH
T1AC02F8396C787CBB9DE3AD15B58B7B139FE5116FE6941F84DAE8162C00DB68C1303522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02f1820c-e81e-498f-a8ed-2cd8477d1fba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\02f1820c-e81e-498f-a8ed-2cd8477d1fba.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fd3587d3-f818-47ea-a31e-6c7524eb0b0a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fd3587d3-f818-47ea-a31e-6c7524eb0b0a.tmp
Size 21KB
SHA256 df0a93f51fe619b97d392979371906343a88a7bb692930d9c484e9972e152d28
MD5 db045ab4e0e76cbce0a4e4075024e8a3
SHA1 f313b5ce97593ef9f078c926fc06a1a310885625
SHA512 1b187ba025754445534dda6806d62db93f5c87870c910a701fb15aa7a7d47cfe992ec64d87f56ab15622df9eebb05145e50bc086d9ced86c9bed4a77b9864f4d
SSDEEP 384:KiFiZcIVzsND8TUNTUlIlykeDNF+p5u8ipaiNalhtgOIwZOy3Zon:BFQtqwgjefMkpUlhXsok
TLSH
T135A27B339C68997BBDEB8A41F54B32038FB441A7D6C4EB85E6DD9A1C01EB4D8030BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 015af31a123f5a99a93e98ac543394084be631ad482abf8eb36594e5a94ee342
MD5 71f8d199be9e155fbd5386c289233564
SHA1 d088d1b761009c534dac4086d1f5c87e3fa7533a
SHA512 5100dd5d0534d5b3a6e5c7ff4b073154e595ad118317bda8fed2365f1d7ed899a59cae069350f3c53e42f01fc88fe77c5186178499c161d5147df7ead6fbe030
TLSH
T1F1413868B6ED1108B3B77E56AFF2A46D487ABD731E07D85E10010E8F0A62A40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download