hxxp://mt1[.]idealista[.]pt/23/tiles/webp/desktop/pt/draw_search/light/zoom15/15584/12388[.]webp

Analysis

user interaction
yes
max time kernel
40s
max time network
43s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://mt1.idealista.pt/23/tiles/webp/desktop/pt/draw_search/light/zoom15/15584/12388.webp
Sample261023-ndek3abs71

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4900	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{0973E99C-AF34-4649-8661-8437C1E6C9F8}	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\12388.webp:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\12388 (1).webp:Zone.Identifier	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 1164	4872	msedge.exe	85
PID 4872 wrote to memory of 4900	4872	msedge.exe	86
PID 4872 wrote to memory of 4868	4872	msedge.exe	87
PID 4872 wrote to memory of 4868	4872	msedge.exe	87
PID 4872 wrote to memory of 4868	4872	msedge.exe	87
PID 4872 wrote to memory of 2060	4872	msedge.exe	88
PID 4872 wrote to memory of 2060	4872	msedge.exe	88
PID 4872 wrote to memory of 1756	4872	msedge.exe	90
PID 4872 wrote to memory of 1756	4872	msedge.exe	90
PID 4872 wrote to memory of 1756	4872	msedge.exe	90
PID 4872 wrote to memory of 4104	4872	msedge.exe	91
PID 4872 wrote to memory of 4104	4872	msedge.exe	91
PID 4872 wrote to memory of 4104	4872	msedge.exe	91
PID 4872 wrote to memory of 4944	4872	msedge.exe	92
PID 4872 wrote to memory of 1388	4872	msedge.exe	93
PID 4872 wrote to memory of 4944	4872	msedge.exe	92
PID 4872 wrote to memory of 4944	4872	msedge.exe	92
PID 4872 wrote to memory of 1388	4872	msedge.exe	93
PID 4872 wrote to memory of 1388	4872	msedge.exe	93
PID 4872 wrote to memory of 2908	4872	msedge.exe	96
PID 4872 wrote to memory of 2908	4872	msedge.exe	96
PID 4872 wrote to memory of 2248	4872	msedge.exe	97
PID 4872 wrote to memory of 2248	4872	msedge.exe	97
PID 4872 wrote to memory of 2920	4872	msedge.exe	98
PID 4872 wrote to memory of 3028	4872	msedge.exe	99
PID 4872 wrote to memory of 2920	4872	msedge.exe	98
PID 4872 wrote to memory of 3028	4872	msedge.exe	99
PID 4872 wrote to memory of 3028	4872	msedge.exe	99
PID 4872 wrote to memory of 3056	4872	msedge.exe	100
PID 4872 wrote to memory of 4724	4872	msedge.exe	103
PID 4872 wrote to memory of 716	4872	msedge.exe	108
PID 716 wrote to memory of 5032	716	msedge.exe	110
PID 4872 wrote to memory of 4300	4872	msedge.exe	111
PID 4872 wrote to memory of 4300	4872	msedge.exe	111
PID 4872 wrote to memory of 4300	4872	msedge.exe	111
PID 4872 wrote to memory of 4676	4872	msedge.exe	116
PID 4872 wrote to memory of 2504	4872	msedge.exe	117
PID 4872 wrote to memory of 4964	4872	msedge.exe	118
PID 4872 wrote to memory of 4192	4872	msedge.exe	120
PID 4872 wrote to memory of 4192	4872	msedge.exe	120
PID 4872 wrote to memory of 4192	4872	msedge.exe	120
PID 4872 wrote to memory of 3240	4872	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://mt1.idealista.pt/23/tiles/webp/desktop/pt/draw_search/light/zoom15/15584/12388.webp
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x258,0x7ffe9671c188,0x7ffe9671c194,0x7ffe9671c1a0
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,14786004211328002610,3751428965708244885,524288 --field-trial-handle=2216,i,16872780637696751856,13672590159680971898,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,11838997408638555733,14767375493225946116,262144 --field-trial-handle=2216,i,16872780637696751856,13672590159680971898,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,4209739487849774373,12150846050837524662,524288 --field-trial-handle=2216,i,16872780637696751856,13672590159680971898,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,6927434522015397134,14312924927043711473,2097152 --field-trial-handle=2216,i,16872780637696751856,13672590159680971898,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,15624766708319553283,7454022919782050218,2097152 --field-trial-handle=2216,i,16872780637696751856,13672590159680971898,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,1129736908659731336,11640909178706507064,2097152 --field-trial-handle=2216,i,16872780637696751856,13672590159680971898,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,17618834087603197318,10932047788958825434,2097152 --field-trial-handle=2216,i,16872780637696751856,13672590159680971898,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,7950125447702029659,4099170280239685935,524288 --field-trial-handle=2216,i,16872780637696751856,13672590159680971898,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,2726543683374489065,16548979993964263062,524288 --field-trial-handle=2216,i,16872780637696751856,13672590159680971898,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,7250856096937508907,10693337396569816431,524288 --field-trial-handle=2216,i,16872780637696751856,13672590159680971898,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5660,i,6293774785454366899,3723777330927200787,2097152 --field-trial-handle=2216,i,16872780637696751856,13672590159680971898,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,402949477269464700,7745663981482808135,524288 --field-trial-handle=2216,i,16872780637696751856,13672590159680971898,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  - NTFS ADS
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,5140812396423382547,4122167934192770489,524288 --field-trial-handle=2216,i,16872780637696751856,13672590159680971898,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,5140812396423382547,4122167934192770489,524288 --field-trial-handle=2216,i,16872780637696751856,13672590159680971898,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\12388.webp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Users\Admin\Downloads\12388.webp
    3⤵
    PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6856,i,14071801478111958764,11427548250403713914,2097152 --field-trial-handle=2216,i,16872780637696751856,13672590159680971898,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,13937846483354133921,10933795034311496067,524288 --field-trial-handle=2216,i,16872780637696751856,13672590159680971898,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,4468228852834280413,14749548603423602037,524288 --field-trial-handle=2216,i,16872780637696751856,13672590159680971898,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,14595338150345926280,3027046215118209223,524288 --field-trial-handle=2216,i,16872780637696751856,13672590159680971898,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4356,i,10251657994446523105,12445482856505196957,2097152 --field-trial-handle=2216,i,16872780637696751856,13672590159680971898,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,4175810160442310004,12626522392219733152,524288 --field-trial-handle=2216,i,16872780637696751856,13672590159680971898,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:8
  2⤵
  - NTFS ADS
  PID:3240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4be2d139-0d95-4a16-a53a-b0dea0c808d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4be2d139-0d95-4a16-a53a-b0dea0c808d0.tmp
Size 18KB
SHA256 08a6aa7481234433418d634e24aa5ef145a1de6f260e95f497797a5c1d7f03ed
MD5 f41cefbf3f62a41f91e0f999df967383
SHA1 125850c51c552daf40da7d2d5eb7db75aed49981
SHA512 a3bff3627bea5c5bb0304e32d0ed613b772d2ee39ff9157dfae891e1e108bbb7325a9e54c3e334b1623f6c9d83b54a9d2fcfd9ab4d2facedfa5265d513bbb12a
SSDEEP 384:5QkUSvXsNnegJB5+4uP2BGYX5Ejl83sIXHky2IWukIIlB9:bXeJB1UwGYujToHky5WukLT9
TLSH
T1BA825D76ACB9AC674DE2A650F14E36038FB49017D6D45F90DAED6B1C01CE2D8234B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

51d36dde-8528-4b5c-afe9-dab465e9cca5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\51d36dde-8528-4b5c-afe9-dab465e9cca5.tmp
Size 10KB
SHA256 645fe01838c0142af5ceb239fb30db3bde08916062f94f2f37eff7a092b61d98
MD5 fe48c36ddeced3c84afe2128ba4042f7
SHA1 0a5a74895069eb184006caac481a460474a8a3e2
SHA512 187bbd00b84f0e7f96cf188411646cc71ef685686af30411cfa415f33176c6f3e0390459dfc98e2d1a0e10bac71c82495343785c5f865fb3fec01c23e08470a6
SSDEEP 192:sxZYR0ng/fgsU+nIdpd4HW6+WNGYgNw0hIg5HJ:sxZYgg/fgsU+oeHbG1T
TLSH
T12322A712AE68697B8CC7D20DBB15BF53D6F9503261D11E98EAFCC61C05EAACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

570eb5e2-3d43-4b8a-b70c-d8944ea9d6c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\570eb5e2-3d43-4b8a-b70c-d8944ea9d6c7.tmp
Size 9KB
SHA256 dc7405479269a5534804a23443705e8c08b687ce02de35ebd8a199dad88d3fac
MD5 208a49a7407f5a2e51aa82547419c081
SHA1 fc0e5bd2650c96aebf9e877b719fc5df837f1470
SHA512 45246eb5551934f75df7b2c21b4bb1c4bff7e958b840e5bfe26bf81ac5bc9987299d3560da68d39be98097976af69848f5f33a06802e2040e404847c151470c1
SSDEEP 192:sxZYR0ng/fgsu+nIdpd4HW6+WNGYgdk0hIgrJ:sxZYgg/fgsu+oeHbG99
TLSH
T18F12B8126E78A57B8CC7D20DBA25BF53D6FA5032A1D11E58EAFC861C05E6ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5bce7568-e0c2-4680-8795-d794edec7c22.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5bce7568-e0c2-4680-8795-d794edec7c22.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75441896-fc2a-4756-93b3-0af6f3017c02.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\75441896-fc2a-4756-93b3-0af6f3017c02.tmp
Size 9KB
SHA256 881abfc53bd5371a89c21ad41536a879d7b2407e2f3a63b1f9424d8d59c00438
MD5 c90dc25e27f2da9b31d991ec51b1dde6
SHA1 b46478769b6543b469124f6f2de55bf80b3b2ddf
SHA512 018704425c24e4c463d9803b752f9853ecedacec03e6b8fd97eb67f97c630c69d3479201efd04a33f3b9d4c4badcbb23b5b10b6d1f33a7c6572b8d668263149c
SSDEEP 192:sxZYR0ng/fgsv+nIdpd4HW6+WNGYgdk0hIg5tJ:sxZYgg/fgsv+oeHbG9d
TLSH
T11E22B9126E78657B8CC7D20DBB15BF53D6F9503261D11E98EAFC861C05EA6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 5a3433a5fd3caf1ccf40fc434f9977406a1b6a26fbbce2ad2faaed5d22fe188d
MD5 60486a6b1cf6e9f9f7cb27c091711e85
SHA1 618cba2235c747be909c7f8017da71d37c489207
SHA512 8de3a5166efb55f920070562f81c134ec8a2e137f4d61a4b849a0d357f558fff33c8e0b75039b0806f19822122999f448454d908137d7b92bd92d14a8cef8139
TLSH
T1626109E4D58182EDF7F8437CA7D13B877A38B4D8B1836D2200A2FC3B540E359AA82074
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2e3785ad00a06721a738a2709360cba33354425a5c4186d3ff0eb21309b960b4
MD5 155a7d0afb667ddf87269ef1493b562f
SHA1 e4d564a7d8824a537a145d24d4c5ef05f9cf838e
SHA512 00cc48cef794fb602498b8baac3759dbe69134cc545df4dda2b0a69b38f2a4e37560478b5bd53d7b291da31d9fafd9ea17aa2f2754acef27847c5f2d4cf8230d
TLSH
T12A61F9E4C58182EDF7F8437C97D13B877A38B4D8B1836D2300A6EC7B540E359AA86074
MD5 SHA1 SHA512 TLSH

Submit Download

d344c549-145b-4d04-814d-e0101aaf0c0e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d344c549-145b-4d04-814d-e0101aaf0c0e.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2fe6a494-2afa-46b6-8559-15e144b8f1af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2fe6a494-2afa-46b6-8559-15e144b8f1af.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

876fe5b3-6a7f-442e-864a-848c9292c858.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\876fe5b3-6a7f-442e-864a-848c9292c858.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

d015ad3f-4c6d-434e-981f-8774f831df7b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d015ad3f-4c6d-434e-981f-8774f831df7b.tmp
Size 27KB
SHA256 c60eb92b56813c5790c279278284cea154cae75254200bdec5ae38baecc1f80e
MD5 66456efe250153dd613a8b5bee4b2bf5
SHA1 e75236b6378a7680961b059844afad8bc28ee1b8
SHA512 7663d0c99ca8d571f16a5a8bb5c21c94a59d84a4e66bea0804a60d28980bec44041f9b4d79cc7b946e01af9b3cebba2517b1cd1750430ac9ae76f08202590392
SSDEEP 768:AJichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzrroex/:AJichfPWvPZplu1jan+LKgzYW/
TLSH
T11AC2FA3B644CCB7E4FC01E9DDD1A6F9A7E9802C7AA588D4047FA984C02C77EE51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dba7b63d-1760-4147-99af-5f111c61d9df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dba7b63d-1760-4147-99af-5f111c61d9df.tmp
Size 18KB
SHA256 07754929ab9f764ef26ca2e4b19c58a1b5fd51cf643a1ae01e501f569e344bb5
MD5 b801de14f8459fb7afd5ee86d2d12996
SHA1 ef0e8acb49453ef16331c96bc0e66aa5e2fb4f9f
SHA512 300c2b026fc52ff5b46ac090ab05e84bd233ab629e9f1d9b164047263453b80fe35093b96a33cc869e0109f4789acc3b51a7e33622dc6bbaf87d05b8e953be76
SSDEEP 384:5QkUSvxsNnegJB5ZvuuBGYX5Ejl83sIXHky2IWukIIlB9:bxeJBv9GYujToHky5WukLT9
TLSH
T13F825C76ACB9AC674DE2A650F14E36038FB49017D6D45F90DAED6B2C01CE2D8234B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e488efca-fa53-4bd3-9efe-658ed750c12f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e488efca-fa53-4bd3-9efe-658ed750c12f.tmp
Size 8KB
SHA256 d4a5cb36cd38dd995db1ce74636ef1b3bb205299d424736531ad85f6a7fb0430
MD5 5b022c11735b4a6b2d6a36c1a1b0e2b2
SHA1 361660eb529c40f5b2b9a56afd0db8ec3c0de6b0
SHA512 e0f03655aaa4c5576f7558f5a7203d5c09b219af8e2f3b8bdbd9d82c8163c00c0803e99da4fbf2cc8e2551f3ff6a527b34e1f66119a454d1f2fba44cae136aa2
SSDEEP 192:LJONI6DphmqQmiUys4Hq8wGYX59ezKCpjzor33Ikk7p9U6:lONI619MRwGYX5Ejl83GXU6
TLSH
T1B702DA35F8787CBB4DE3AE45B44B27139FE5212BAA946B54DAEC1B1D00DB64C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6df3323-b5a5-445b-b992-eacb717049e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e6df3323-b5a5-445b-b992-eacb717049e7.tmp
Size 18KB
SHA256 a708367e859c4312da5be11e752419a7879a504a090e7bae8fdabe197f4b4744
MD5 74e4594e76b1258cc26c95b404a679f1
SHA1 b3a0249332201eafc39f84c7a15b6ea246782cb0
SHA512 1eab74ebb2a7a05e23f314bb6a90cf23416e27c907ede1c2b07fe715ba254f8db8f0459c70bb07d94b6f4e9a4ed3679e37e7d295ea0351820d0c58653ed98740
SSDEEP 384:rQkUSvXsNnTgJB5+yuP2BGYX5Ejl83sIXHky2IWukIIlB9:lXrJBnUwGYujToHky5WukLT9
TLSH
T152826D76ACB9AC674DE2A650F14E36038FB49017E6D45F90DAED6B1C01CE2DC234B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee319eef-5b57-40e8-bcfe-d7013e8de1cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ee319eef-5b57-40e8-bcfe-d7013e8de1cc.tmp
Size 8KB
SHA256 af0d3a6af284505101957d835ed59565d86d0d9d743eec016b14d974c69e674e
MD5 8b534a908d51b45fc26388f7ee2fb09f
SHA1 c9aeb57ee38639ff0b3374d52c2e1f069670156e
SHA512 d1430f1af572b9eb040a56f13f2a9d2607e84c3216d2854f6dfce3c4be1be77818a0685f4f67f0531721c5f960d9945b5cab3d7addc5aaeeceb0fc0dd5e30c93
SSDEEP 192:dONC6DphfqQmiUyshHhwGYX59ezKCpjzor33cIXEElkIILq5zU6:dONC610thwGYX5Ejl83sIXHOyU6
TLSH
T10A12F932B8B8AC6B1DD2A595B04B36139FA4512BEB846F50D6FC1B1C02DF69C130A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e5057b0-fdbd-4e76-b06e-c0c7bbc89647.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9e5057b0-fdbd-4e76-b06e-c0c7bbc89647.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6c6319ee07a8cb4985443d89b47b5112b05c8fc5dca92ecd80ca5129d5d3d12b
MD5 1a8b6196d4257ce033f734e8c8f89793
SHA1 e816d2e9692c13711f1fd13b43e45211e06a0898
SHA512 8d44449b83a7472de76c851cfe13ac49ae2ce0247fefc55ed8d8f41f7f1317daba32d6b85598ab390f0a34b0daa7930e237194594964fc87ff1d2f44a0527dae
TLSH
T182412B58EAF91148B3B76E559BF2A86D887ABD772F06D59E00010D4F0A73B40C872B37
MD5 SHA1 SHA512 TLSH

Submit Download

12388.webp:Zone.Identifier

Path C:\Users\Admin\Downloads\12388.webp:Zone.Identifier
Size 127B
SHA256 bb649cd637f2b64e6a4f01bd328b5a4abddefe3387374851a21c1b8a924b5692
MD5 bed1fa395d316dd5903e32f5b72c2a9f
SHA1 3fb4be795c9e3b23e23bfcf3bcb0b6d9554e6376
SHA512 36fc0887cbcca4224e857b04261c1a58545edc13ff88614fe07e841a6b44853bc12d427ba9ef4242a601d5e2b056fcb187daccddc05a5c27ffb592f353562316
TLSH
T180B09B4B0C144C4C4BF7314F55EDE455FA0DFE505C594280E9D44595469275C72D5CBA
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads