13115ce4e757e91f27c357c00be87116b1f4929165c601bdb3630a3866a6050d

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/11/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tonality-andy-james-guitar-plug-in-suite.html
Size 368KB
Sample261102-e85lassw6m
SHA256 13115ce4e757e91f27c357c00be87116b1f4929165c601bdb3630a3866a6050d
MD5 46514835db5e98bab74142fe16667dd8
SHA1 4dca44fb85438357542eff72a38d1fc38f24ca51
SHA512 c5107170bf4b75a0b91011938442da824efd9d49b1a525a836771554dd42fe4126c88e70e6ba9671781e47dcfdd699b16b6da8a9153ff208a174acc4ddee37a9
SSDEEP 3072:PfSpI7Xq1InLBq1nfm3Jrcjtbxk1y2hSBHMRavTNEjSR88rPZ18T+pgUX1eEuytG:XSITq1InCue3wEuytLy
TLSH
T1F3844C96B9B7103501938DB97BB76E4972389007C644C8647EED87880FD1BD6CAA3F9C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3076	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2322150968-3922673059-3248713381-1000\{AEDB89D7-D92A-4ED2-BFCC-E2129E414DEE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3528	msedge.exe
3528	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 3560	3388	msedge.exe	81
PID 3388 wrote to memory of 3076	3388	msedge.exe	82
PID 3388 wrote to memory of 4712	3388	msedge.exe	83
PID 3388 wrote to memory of 4712	3388	msedge.exe	83
PID 3388 wrote to memory of 4712	3388	msedge.exe	83
PID 3388 wrote to memory of 1824	3388	msedge.exe	84
PID 3388 wrote to memory of 1824	3388	msedge.exe	84
PID 3388 wrote to memory of 1104	3388	msedge.exe	87
PID 3388 wrote to memory of 1104	3388	msedge.exe	87
PID 3388 wrote to memory of 1104	3388	msedge.exe	87
PID 3388 wrote to memory of 3776	3388	msedge.exe	86
PID 3388 wrote to memory of 3776	3388	msedge.exe	86
PID 3388 wrote to memory of 3776	3388	msedge.exe	86
PID 3388 wrote to memory of 4716	3388	msedge.exe	88
PID 3388 wrote to memory of 1708	3388	msedge.exe	89
PID 3388 wrote to memory of 4716	3388	msedge.exe	88
PID 3388 wrote to memory of 4716	3388	msedge.exe	88
PID 3388 wrote to memory of 1708	3388	msedge.exe	89
PID 3388 wrote to memory of 1708	3388	msedge.exe	89
PID 3388 wrote to memory of 4432	3388	msedge.exe	90
PID 3388 wrote to memory of 4432	3388	msedge.exe	90
PID 3388 wrote to memory of 4432	3388	msedge.exe	90
PID 3388 wrote to memory of 3248	3388	msedge.exe	91
PID 3388 wrote to memory of 3248	3388	msedge.exe	91
PID 3388 wrote to memory of 3248	3388	msedge.exe	91
PID 3388 wrote to memory of 4024	3388	msedge.exe	94
PID 3388 wrote to memory of 3652	3388	msedge.exe	95
PID 3388 wrote to memory of 4024	3388	msedge.exe	94
PID 3388 wrote to memory of 3652	3388	msedge.exe	95
PID 3388 wrote to memory of 4476	3388	msedge.exe	96
PID 3388 wrote to memory of 1436	3388	msedge.exe	98
PID 3388 wrote to memory of 2060	3388	msedge.exe	100
PID 3388 wrote to memory of 2060	3388	msedge.exe	100
PID 3388 wrote to memory of 2060	3388	msedge.exe	100
PID 3388 wrote to memory of 1684	3388	msedge.exe	101
PID 3388 wrote to memory of 1684	3388	msedge.exe	101
PID 3388 wrote to memory of 4120	3388	msedge.exe	102
PID 3388 wrote to memory of 3684	3388	msedge.exe	103
PID 3388 wrote to memory of 2960	3388	msedge.exe	104
PID 3388 wrote to memory of 2192	3388	msedge.exe	105
PID 3388 wrote to memory of 2192	3388	msedge.exe	105
PID 3388 wrote to memory of 3528	3388	msedge.exe	107

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\tonality-andy-james-guitar-plug-in-suite.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffb6c8fc188,0x7ffb6c8fc194,0x7ffb6c8fc1a0
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,4802677909280500982,10479521676592900986,524288 --field-trial-handle=2140,i,12001371334437417874,6614776837309647356,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,6068105676118872435,678266249497066238,262144 --field-trial-handle=2140,i,12001371334437417874,6614776837309647356,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,1704094313353045079,2170047828915565885,524288 --field-trial-handle=2140,i,12001371334437417874,6614776837309647356,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:13
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,14965115328616740801,17465025880999071543,2097152 --field-trial-handle=2140,i,12001371334437417874,6614776837309647356,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,16275115863230492154,2781763617644574445,2097152 --field-trial-handle=2140,i,12001371334437417874,6614776837309647356,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4112,i,17489845459674271254,1146295436531494662,2097152 --field-trial-handle=2140,i,12001371334437417874,6614776837309647356,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,4871155859623079841,837347491380379472,2097152 --field-trial-handle=2140,i,12001371334437417874,6614776837309647356,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:9
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4232,i,9071859497183929569,2856420292079943792,2097152 --field-trial-handle=2140,i,12001371334437417874,6614776837309647356,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4356,i,5955090373498788213,2766519098648924177,2097152 --field-trial-handle=2140,i,12001371334437417874,6614776837309647356,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:9
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,378921326325553821,972538990042146372,524288 --field-trial-handle=2140,i,12001371334437417874,6614776837309647356,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,3498565833494818944,5366683402998650097,524288 --field-trial-handle=2140,i,12001371334437417874,6614776837309647356,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,5593289530970707336,7445245789211943538,524288 --field-trial-handle=2140,i,12001371334437417874,6614776837309647356,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,4097152321135071485,3064307659852826233,524288 --field-trial-handle=2140,i,12001371334437417874,6614776837309647356,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:14
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,4097152321135071485,3064307659852826233,524288 --field-trial-handle=2140,i,12001371334437417874,6614776837309647356,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:14
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4796,i,365645184174130565,5101164680256971761,2097152 --field-trial-handle=2140,i,12001371334437417874,6614776837309647356,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,11545949832351331834,17024235111716487396,524288 --field-trial-handle=2140,i,12001371334437417874,6614776837309647356,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:12
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,9557236246963578074,10036530887333994713,524288 --field-trial-handle=2140,i,12001371334437417874,6614776837309647356,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,39493848493056068,17823523517312823698,524288 --field-trial-handle=2140,i,12001371334437417874,6614776837309647356,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:14
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,13130102752187601396,6469325474852080601,524288 --field-trial-handle=2140,i,12001371334437417874,6614776837309647356,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,6340991746932047601,8839045885420738220,524288 --field-trial-handle=2140,i,12001371334437417874,6614776837309647356,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4788,i,7509099967832298544,11101841183559401920,262144 --field-trial-handle=2140,i,12001371334437417874,6614776837309647356,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7f9e1e50-7b9f-468a-bcfd-767d478b7046.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7f9e1e50-7b9f-468a-bcfd-767d478b7046.tmp
Size 8KB
SHA256 3a3ac3162b981c950333a1411a3b84b312ceaff5e650da2c76690ef01527c5fe
MD5 8d70bc289da96bb0ae754fdaea9c4b52
SHA1 2fe9d3055ea3f37690d843a0abbe70986d315c07
SHA512 d23d5b29ef57062434bd883242b617445a2838d69bc6dfdcc530020f02775daaf0dc05b88a2228d80f11e1c6faba5953c63db3bc8e67246ed10ac38427665445
SSDEEP 192:9GNt6UbxQmiUy0Jpk+W9XPaPeRBr5C2FU6:9GNt6IPPJq+kSW5zU6
TLSH
T1DB02D635AC687C7B9EF6AE55B5873B139FA5102BE9952F84DAE81B1C00D764C1307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e283543-7431-4e93-bdff-22049d5a3c99.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8e283543-7431-4e93-bdff-22049d5a3c99.tmp
Size 18KB
SHA256 162ba1aabb234d41659b8ed59500f74ec74aac46d6abb057f018ea00da5eb8c7
MD5 e165c9f137a1b13e5aae6cd86696cd14
SHA1 3ac9163f53827b24b816cece9e161c676cb08b95
SHA512 8256d1eaf9f9526eb3e705d66d5449f3fb8875e7d0dba6d24e334c80688e4b891cd9f3450668de1da2ae59e392f2939bca86475958cfb6eb419cbeb0bc8f3aff
SSDEEP 384:kQkUSv78Npl3k/m63XQ5SWqtBUH7vBEVzIIl7:U7njtBUH75EVzL1
TLSH
T1C6827C71AC696C3B49B3E511F14A3653AF74D02BEAD82F90D8DE6B1C01DA5CC630BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c200aa4-c62c-4c0e-a0c4-9bcd9aece615.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9c200aa4-c62c-4c0e-a0c4-9bcd9aece615.tmp
Size 18KB
SHA256 757589db1a1544d36757ff71b5d2890b20befbe7133c0ff1728b81d3503da354
MD5 e732e698b2da8165116a3ca25f31bbc5
SHA1 aeb92d464049d0af2d5d34efb0b53c0b95eb8982
SHA512 31745d074277af133582776fa432dbd20bc64fbfc97f67d62e3ddb43728e8344334ffbb86dbfbeff2c14b7a4e19459b4c9515e1eda0f987f858cbdb32676daf0
SSDEEP 384:XQkUSv78Npp3k/m63XQ5SWqtBUH7vBEVzIIl7:p7XjtBUH75EVzL1
TLSH
T108826B71AC696C3B49B3D511F14A3653AF74D06BEAD82F90D9DE6B1C01CA6CC630BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0714e6f61cb4ee87df081093ea45647348bd6b088c2ac1e6188d495c78e99d7e
MD5 2fe08827a42341294e10b9edd0b51268
SHA1 9825b24ae78e2cde9480297e7e4013d6c0959b16
SHA512 7a0465cafbdfbb547a5cef98322581d1e80a528dd4189337fb6b5b13ed414e2f42b21bf71aa7a23f7a751b405de9800d7ecb96c64b25f954ebb7a1f0780507ac
TLSH
T19CD0112AFA222E02E000E232802ABA82020080828C8208088A800222A8C2802882B22A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4da83f7c2db56b3b267d8673cd329c9ebe11518ed1355fee48e02e2eb7dc667
MD5 da5bf6bf079a2d0b72f1ba828bb869c4
SHA1 c5b477ca5fa0737bc5ec1d3971d7c5864a969233
SHA512 4bb0cdef8b5998fe4d7dca2c5da777f9d5541df6ec2a269e22d862e25cb11ad1dd6794d959246e60431138d67653ebeed6d6a8ad98885459f62f51a91e4f6048
TLSH
T17CD0222EFB232E02F800E332803CFB830200C0C3CC830A088E800222E8C38028C2B32F
MD5 SHA1 SHA512 TLSH

Submit Download

01bd74d8-4408-4cf2-9381-f666a02a4e33.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\01bd74d8-4408-4cf2-9381-f666a02a4e33.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b7ee208-461c-40d7-af26-b06167ce4f60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2b7ee208-461c-40d7-af26-b06167ce4f60.tmp
Size 10KB
SHA256 7dab4386cfb6597dc10b4ff6b0d27d72e9de5efbee21cb4b75f63b52748b991f
MD5 2ffbd62ad0c35899ca41c98b9235b501
SHA1 9e258891b33f8c3f27e08331da733ccdbb6705d2
SHA512 f2b908de4df74ede2877363d72766e4757efe734d2c9cbccb0cf5f90d46b9ddc78c5822cdbedfc4a2f2e4217aa3059a929b643decf2b3770a9223b7bc088d595
SSDEEP 192:sxZ8RAbS/fksWJsO/IdpyI/W6+WNGY0CUxT98Ig56J:sxZ8oS/fksWJs5L/bG5Xuk
TLSH
T1D722D751BE28683B9CCBE209BA15BF43E6FD503291951E58A6FC861C05E7ACD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76f2c9bd-6e03-4f49-a739-a227cbce43dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\76f2c9bd-6e03-4f49-a739-a227cbce43dc.tmp
Size 9KB
SHA256 da51e458f62e410cc793b20bbb16d33250ee3f035f6a071a8bfad8fec1f98336
MD5 a656ebd3e01c56cb17d8ebe9033c5411
SHA1 e46c008f63495bab1603361f93a3ffbf2be18146
SHA512 837782a5d49b3c1f2685b7a7431e1dcc22a06f3df9264919cbfb0d733f8d66f26b5815b66f1ecf1797247a779fdfda8d948a1f44acb0753932a9efa4d687e41c
SSDEEP 192:sxZ8RAbS/fks04QO/IdpyI/W6+WNGY0C9JT98IgrJ:sxZ8oS/fks04Q5L/bG5Ou9
TLSH
T1AC22C7117E28653B9CCBE209BB15BF43E6FD503291951E58EAFC961C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

85b34d18-b83c-4e1f-a980-0889262bd2d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\85b34d18-b83c-4e1f-a980-0889262bd2d3.tmp
Size 28KB
SHA256 1d9f53b289df4de13d32c72f0a7b8c31029a1a262ebf30f362a442a5dd352774
MD5 9e237b4b056977d61cc6a07db18f6fc5
SHA1 bae3237c9572baec404d0638e37a2c80e40e21ec
SHA512 7c545dc108b5ebb807153fdab32a5c408058cb71db1d19ac462bd8b7d7dfcf73608bfe5dfb12edcf025db869ae93d048509f8dadd9b2cbc59cd64dbcc01d2561
SSDEEP 768:qalTj8Gr2ymWRm+KQEC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3MxLl/C80flVroRf:qalTj8Gr2ymWRm+KQECu1jaKMxLpCNfs
TLSH
T186D21B3F240CCB7E5FC40A9DDD566F976E9802C7A6688D4047FE984C02D77EA912A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 e4880df6b947631c37f30a5da7afbefda7fbc71342386833ee5d1b45a97712f0
MD5 900ac92f68dfdb54dfa80bca82752565
SHA1 c1d2baf3d70d2df4eb19e7bc0d0aad64a3f3b3a5
SHA512 da83f2e5fc4aaf5d3930dc7b85226f807e9ba79ad2a8cf5ae4f368b758fad77814b84e5d714c61b1106041dfa18eb7aec800b30af6f6bb0d423980f7074338b2
TLSH
T157514C504797F3AAD7A88779C5D4128732372886FB436FD203A4F6BC49EAF271318218
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 38f934b14e525ccff3aae4b17a706fae8fd6e6fdab4480b243d77ccf25083d27
MD5 90bb56ece5b364afb2995733b50618d7
SHA1 455a917ec6bfad518931d4a03017c80ae66c36a2
SHA512 23db5efe2803e7e246c37c39243bef4fa9efcc0e8960e9975322e826bc10c80531e93f8b2f313cf8676d9adc7b032c5e21370bf6a057c24e556d33afc982d348
TLSH
T193513C514787F2AAD7A88779C5D4028732376886FB436FC203A4F6BC49EAF171318218
MD5 SHA1 SHA512 TLSH

Submit Download

60ca890a-7705-4ce4-a2f3-0ca7712a2d7e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\60ca890a-7705-4ce4-a2f3-0ca7712a2d7e.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1843d03f-b8f9-46aa-ae48-c43da695509f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1843d03f-b8f9-46aa-ae48-c43da695509f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c7b965c2-56b4-4c5d-b555-b825c1f7f3cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c7b965c2-56b4-4c5d-b555-b825c1f7f3cf.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

f59ca95b-678c-46c7-a527-d7481eb97152.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f59ca95b-678c-46c7-a527-d7481eb97152.tmp
Size 5KB
SHA256 a574a7458467ce5f897728ba058d3a89f00850c3d9f82aa3a2883aa4a02721ea
MD5 b4dc60d179ca3a6f359a61a895b16250
SHA1 a0e44ca8d67dc4c07a69e129aacb7b9f1d74e48c
SHA512 d4a43d16524fa6de3590ec948aaac6f9522379fa40c1b268a5851ad372f29fc4259c4c6eb19b731ea75cbdc4997436d5e47e648af4cb6cce3263ac0b254f8014
SSDEEP 96:D+qmiOA/zjRZbKHzBMVeZB7X3Z7ZKLGYjbVZmgZmZnuZxwT/G:D+qmhA/zNZbKHlMVeZBD3Z7ZKLGQbVZN
TLSH
T11DB1ABF6C2D8837E882156F19B257A2ACD1D155B422C3C568CF4AF5F23F25B0E20229F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f98a002e3d515303a619ad3264e10ddd4147bc57b4bdd608a660170475e88eb7
MD5 9223f97093c589c35d3afe4df8c8a32e
SHA1 0af9a36b1c66c687b75354d4a2b58eb7f17ada90
SHA512 89ea1bf113adb39860210508db9e8f7524b13c6c489373104273f7b2b75978a8a64e89cbc87cd209c11a55438be2b80773bd288bdb31bf67ec445df707e244a8
SSDEEP 96:KUwgKtGraGgKPKyTWHjVBdc1RgH/7cKnJ/9cDzjAFzBM:i6nQnM
TLSH
T1079172A5316A06853D7E240C41FA965B528132B3B01CE9BB7FBC90A24E77E041CFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d0fd4fc4-232d-4f35-a829-6be67cdce294.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d0fd4fc4-232d-4f35-a829-6be67cdce294.tmp
Size 10KB
SHA256 420f7c6fd021664012186d6031d3fb0d3379427ae04e0f916daa63eda19181d8
MD5 241761e7a06b27234d133b0bc7ff8cd5
SHA1 fe9303462e0053560fdbfed8b9129856f1e1fa10
SHA512 693a76facccfb001e288d3fd3654055a618bebeff5dd75b37ec19ba5f29a9167407e8432a224989dfcdfe16e5f956d93fd5dfbfd2aff07686bfdbb2b6910db3b
SSDEEP 192:sxZ8RAbS/fksWJsO/IdpEI/W6+WNGY0CKeT98Ig56J:sxZ8oS/fksWJs51/bG5wuk
TLSH
T19E22E652BE28683B9CCBE21DBA15BF53E6FD503291951E58A6FC861C05E7ACD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d1184830-cab9-4cf4-bbc2-9c6807984dce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d1184830-cab9-4cf4-bbc2-9c6807984dce.tmp
Size 10KB
SHA256 051f9d364cd4310174101f67e9ed8d03c0bf622b6286637db6562b974a786f53
MD5 98bc50d946244aa91eb228b83bec8aef
SHA1 a385d2ea7b16451035fe56943248fe207c825d3a
SHA512 47963b2d5f6c8f8719c53c466ed40af4c649e7b8c30aef32718f8bbb0551e58c70f3dc1ec93f17c07bf5dcf3666e13d388f820740b442ed288cf076b0657a39a
SSDEEP 192:sxZ8RAbS/fksW4QO/IdpyI/W6+WNGY0C9NT98Ig5YJ:sxZ8oS/fksW4Q5L/bG5Eum
TLSH
T1D222D711BE28653B9CCBE20DBB15BF43E6FD5032A1951E58A6FC961C05E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d159b691-ff4b-4f79-aba5-586c63a7fb3c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d159b691-ff4b-4f79-aba5-586c63a7fb3c.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

95761a73-5da4-49e7-89c3-5ebc3aad1440.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\95761a73-5da4-49e7-89c3-5ebc3aad1440.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a09154c1-2fef-4f51-aa27-efb3e9e3844e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a09154c1-2fef-4f51-aa27-efb3e9e3844e.tmp
Size 21KB
SHA256 bcca355debb744344aca35fcf26892851a90652af76aeb26a6f800e9ec21bec1
MD5 29b0bd470ede404a4a9e7a07aa5e103b
SHA1 e3362d0945d1dd74c5af4f24412a5e281408c9c7
SHA512 b42881f65ac25a4e407eaa6894c5179c2cfa32e612552df6268be120563b7f6e96fd48cd4afa7389acf83d59fad2744bf40dabb853f4b5c3fad2017d728c0d16
SSDEEP 384:6iFuQkUSvN8NL8TUNTUlIlg3k/m63XQ5SWqtlUH7vBEVzIIl7:xFeNSwghjtlUH75EVzL1
TLSH
T1F0A26C729C989D3F9DB79A11F64A3213DF74806BD9D96BA0E6CD6A1C01DB1CC230BD21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d360e2b2-5712-4511-a5b5-c77678377782.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d360e2b2-5712-4511-a5b5-c77678377782.tmp
Size 18KB
SHA256 e2399f6ac8d63adf19aafb17806412c576db0289a2040b5b96c06fbaf79369ac
MD5 b65b895ae3bdbc62731e294f1b23e39b
SHA1 17c2b63322155d989193fedb16389743d23ab5bc
SHA512 d358c33cd5de8e986b7086e9ecf77b2eb80a40c6b38b45412dba92369c342766baa1210a288d8662b552d7c9a71080371044be1f07496effdbf5af8db9a986e1
SSDEEP 384:NQkUSv78Npg3k/m63XQ5SWqtBUH7vBEVzIIl7:37cjtBUH75EVzL1
TLSH
T1B7827B71AC696C3B49B3E511F14A3653EF74D06BEAD82F90D9DD6B1C01CA68C630BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edc95004-d781-417e-bdc4-982ad55ea1ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edc95004-d781-417e-bdc4-982ad55ea1ce.tmp
Size 8KB
SHA256 489dc10eff10237b9368c0cb4a7c80742ab6879990d7c67a9b25a135ebe82446
MD5 6068d1ee658183003a10bf3b84066739
SHA1 8752bb5a244ad07c71f1e93bcb2f4c5196ee6bf7
SHA512 3881e72446b636a27a39dd67eb6529e268d86f9a31794b397271ac8c4cad28aad50b61b2822eabaaa9c4378fa5a7086787fcf27d631cace15eb3dc7278af004d
SSDEEP 192:5GNE6UbHQmiUyAkQW9XPaPeRMtcPKyqEU6:5GNE6IpOQkSWqtHUU6
TLSH
T187123A31AC687C7F5DA3A961B48736139F75912BEB897F80D5EC2B1C01EB59C530B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23da9680-4eef-4cea-8686-df386e54f5c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\23da9680-4eef-4cea-8686-df386e54f5c9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download