hxxps://nam[.]safelink[.]emails[.]azure[.]net/redirect/?destination=https%3A%2F%2Faccount[.]microsoft[.]com%2Fservices%3FlaunchRenewDialog%3Dtrue%26modelId%3DCFQ7TTC0K5BF%26OCID%3DAID_ema_TRX_RecurrenceRenewalReminder&p=bT1jMjg1NmE2MS0zNzk0LTRkMDQtOWI4OS1kOGE4ZjEwYzFkNjcmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1zZXJ2aWNlc18y

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Faccount.microsoft.com%2Fservices%3FlaunchRenewDialog%3Dtrue%26modelId%3DCFQ7TTC0K5BF%26OCID%3DAID_ema_TRX_RecurrenceRenewalReminder&p=bT1jMjg1NmE2MS0zNzk0LTRkMDQtOWI4OS1kOGE4ZjEwYzFkNjcmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1zZXJ2aWNlc18y
Sample260722-dd5gdaaa25

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
868	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291624898793362"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{6B9C0D20-B700-4D34-99C6-A7912D71D641}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2828	msedge.exe
2828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 2184	4116	msedge.exe	82
PID 4116 wrote to memory of 868	4116	msedge.exe	83
PID 4116 wrote to memory of 4516	4116	msedge.exe	84
PID 4116 wrote to memory of 4516	4116	msedge.exe	84
PID 4116 wrote to memory of 4516	4116	msedge.exe	84
PID 4116 wrote to memory of 4120	4116	msedge.exe	85
PID 4116 wrote to memory of 4120	4116	msedge.exe	85
PID 4116 wrote to memory of 3856	4116	msedge.exe	86
PID 4116 wrote to memory of 3856	4116	msedge.exe	86
PID 4116 wrote to memory of 2380	4116	msedge.exe	87
PID 4116 wrote to memory of 3856	4116	msedge.exe	86
PID 4116 wrote to memory of 2380	4116	msedge.exe	87
PID 4116 wrote to memory of 2380	4116	msedge.exe	87
PID 4116 wrote to memory of 4948	4116	msedge.exe	88
PID 4116 wrote to memory of 4948	4116	msedge.exe	88
PID 4116 wrote to memory of 4948	4116	msedge.exe	88
PID 4116 wrote to memory of 4152	4116	msedge.exe	89
PID 4116 wrote to memory of 4152	4116	msedge.exe	89
PID 4116 wrote to memory of 4152	4116	msedge.exe	89
PID 4116 wrote to memory of 1556	4116	msedge.exe	94
PID 4116 wrote to memory of 3172	4116	msedge.exe	95
PID 4116 wrote to memory of 1556	4116	msedge.exe	94
PID 4116 wrote to memory of 3172	4116	msedge.exe	95
PID 4116 wrote to memory of 3352	4116	msedge.exe	98
PID 4116 wrote to memory of 1668	4116	msedge.exe	100
PID 4116 wrote to memory of 1668	4116	msedge.exe	100
PID 4116 wrote to memory of 1668	4116	msedge.exe	100
PID 4116 wrote to memory of 4476	4116	msedge.exe	102
PID 4116 wrote to memory of 4476	4116	msedge.exe	102
PID 4116 wrote to memory of 4476	4116	msedge.exe	102
PID 4116 wrote to memory of 4576	4116	msedge.exe	110
PID 4116 wrote to memory of 1700	4116	msedge.exe	111
PID 4116 wrote to memory of 976	4116	msedge.exe	112
PID 4116 wrote to memory of 1772	4116	msedge.exe	123
PID 4116 wrote to memory of 1772	4116	msedge.exe	123
PID 4116 wrote to memory of 2828	4116	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Faccount.microsoft.com%2Fservices%3FlaunchRenewDialog%3Dtrue%26modelId%3DCFQ7TTC0K5BF%26OCID%3DAID_ema_TRX_RecurrenceRenewalReminder&p=bT1jMjg1NmE2MS0zNzk0LTRkMDQtOWI4OS1kOGE4ZjEwYzFkNjcmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1zZXJ2aWNlc18y
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffbda2ec188,0x7ffbda2ec194,0x7ffbda2ec1a0
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,12807530282803783156,16844641049490727729,524288 --field-trial-handle=2220,i,13616421276188402804,4757394228055503371,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,2668253844639264543,2180006555199730304,262144 --field-trial-handle=2220,i,13616421276188402804,4757394228055503371,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,11533439217378079263,11972294478086181385,524288 --field-trial-handle=2220,i,13616421276188402804,4757394228055503371,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,14186326647846910095,6229941885972360002,2097152 --field-trial-handle=2220,i,13616421276188402804,4757394228055503371,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,1811250447324213974,10882917879493028697,2097152 --field-trial-handle=2220,i,13616421276188402804,4757394228055503371,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,14244829339009890353,8859946837759180258,2097152 --field-trial-handle=2220,i,13616421276188402804,4757394228055503371,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,15004887780808097679,17226376152740699306,2097152 --field-trial-handle=2220,i,13616421276188402804,4757394228055503371,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,16937327305009724890,6170186496601063110,524288 --field-trial-handle=2220,i,13616421276188402804,4757394228055503371,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,17615003630183733806,14453915873245316600,524288 --field-trial-handle=2220,i,13616421276188402804,4757394228055503371,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,12431645334008394872,18355818768995417451,524288 --field-trial-handle=2220,i,13616421276188402804,4757394228055503371,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,12431645334008394872,18355818768995417451,524288 --field-trial-handle=2220,i,13616421276188402804,4757394228055503371,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6200,i,16693256553762419386,13157599143159288078,2097152 --field-trial-handle=2220,i,13616421276188402804,4757394228055503371,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6004,i,9093345635585875051,12943620262638178230,2097152 --field-trial-handle=2220,i,13616421276188402804,4757394228055503371,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,8263407539532895681,9775350541043141997,524288 --field-trial-handle=2220,i,13616421276188402804,4757394228055503371,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,2878633746930067158,17252395982167488975,524288 --field-trial-handle=2220,i,13616421276188402804,4757394228055503371,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,6150845568563083185,5261440200115001786,524288 --field-trial-handle=2220,i,13616421276188402804,4757394228055503371,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,16795401067692670059,15603142171059234725,524288 --field-trial-handle=2220,i,13616421276188402804,4757394228055503371,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5812,i,314348305020572601,13165901189682229886,262144 --field-trial-handle=2220,i,13616421276188402804,4757394228055503371,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e5b2b397bf07dbfd730cdd42589a3e2c7ac8fd96da1aa248395b15f892d1be81
MD5 afaa26c32d5053612fd1b8eda25c1de4
SHA1 158c6e983e4648b8ee80cd2adb0ae06109ed5e40
SHA512 39674b5837e83971d5b88c5cfaaa7138a515e92b8dfacc0e3d547b37c16ff9ba96b95c5735aba5e4012c7b87968d9545134afdf09a305b61c7fe32cc6e988c05
TLSH
T19C615E3800455C53EBC52573E0FFD90474BA85DAFBA3EE2691336CBD6A0E765804DAD8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5902c5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5902c5.TMP
Size 3KB
SHA256 d7cc96a1e4145d7d48ba5c0fd315b7256dea5c1c877bf62c6fa3ba92aaf43290
MD5 cc6f5fee63731a06a3b1469639e42f2f
SHA1 bbca2f828e4e0adfda90b3df65aabedc4badbf8b
SHA512 9db535c08d1fb7be54b26856e4b4219e896d67867d86b762deccd668188c0926bd9997ea31e3cdb4caa013ab4eafe152919f8ed729a64c4f12565589f5352511
TLSH
T11B612C3800554C53E7C52133E4FFCA4474B985EAFBA3EE2691376CBD6A0E729814DAD8
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8014093abb884fbe4fa012659344b137c6476c4ab211ce3551c6d595958db24d
MD5 4b348fb6a9b387fdb61a1db70ce47029
SHA1 7dc4f29a3e6b0fb20d7d4b43e9c2de46335b7032
SHA512 1efc8f21ae6cf79da552298d7b070a406de8740130b96f8536f83a96788b3609e89a65241272effdf3224ab3736352bf8a909218fe1640df54d7426aba590d2a
TLSH
T1D9317CF787B185AECE1196F4AA18EE1BCE2C0512436C7859C5D4AE17D7F34B1E002A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 51e44f0a6bf0edd66a1e57d3b06b794050fcbbacb6e40e26b91498b20cf02bb1
MD5 3aa2840dca3d9b302ba7ba0b38dfba2c
SHA1 de1cad6c050e80c58e7980fe85f342a0f695b28d
SHA512 a2670b8a1855b74c2eb1d37bd8762437e7d1396877d1e3880ea06a3ca1f8917a5da24e0d2509702c5b8b31c16ff5d05cf97be96b4e0bdac015c756d27848c017
SSDEEP 192:sxZoRDkw/f7sU8YyIdpLBHW6+WNfv1/Y9Ivo7iJEIgrJ:sxZoyw/f7sU8C9Hb1/69
TLSH
T14E229717AE2899774CCBD219BB15BB13E6F5503291D51E58EAFC8A0C04E7ADD630B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 fb1c3ca64983d717bbfae06d3943910ff165723a29fffdd6bcc5193d896c3418
MD5 1fd128b1a07c2482acc1a0ad1d25b485
SHA1 9ba380599a2f8b26d73dad2f17064b2d1be51b9a
SHA512 17f204fce1388d6df4fd25f53c4a8df951d31a9e9e822dc1165790fa510ccb1fc9a1708c3d76924266388488e1ecb0d8fcfa93024c085c817c539787d4924722
SSDEEP 192:sxZoRDkw/f7s8uYyIdpLBHW6+WNfv1/Y9Ih87iJEIg5TJ:sxZoyw/f7s8uC9Hb1/U7
TLSH
T13532B717AE2899779CCBD20DBB15BF13E6F5403292951E58AAFC8A0C05E7BDD630740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 537952b1d4ef07086de78a138892aa4eebc209c0bae52114510ceff160eab9dd
MD5 facc82a27f0395560c2dc92cb59082f8
SHA1 d970ce3251a1f023803f6cd94efd42eb798c8a04
SHA512 53eb217fc4f2ac16b9289cb12edc7c0a0e6f5e89ce393d3f6f398a91ea33bc3d36829a9faa4a9cade68c1db4a21da073331d5078f435c557eb584b5af013cfd4
SSDEEP 192:sxZoRDkw/f7s88YyIdpLBHW6+WNfv1/Y9Ivo7iJEIg5pJ:sxZoyw/f7s88C9Hb1/6V
TLSH
T1DE22A817AE3899778CCBD219BB55BB13E6F5503292D41E58AAFC8A0C04E7BDD630740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 5af3a7714c2004b87a499d86bf6e68a2f89e3f77808e2382051deea001af2441
MD5 b9f2de335b5df11479fa40c4456225f6
SHA1 b64bebe3749f41d45104dc9e03e7a523eb6a7391
SHA512 c783a8ddb621d894004abca9f4b61d0b53fd0a613448712049889d158b0017ef1b3a887857373936d89972beb5b0cb810e76b5cc8b8283f6f938e97ada8e7abc
SSDEEP 768:ZHyvIZwWvu+Q+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW7Cro+bq9:ZHyvIZwWvu+Q+u1jamFLeR7Z+E
TLSH
T1C4C2E92F240CCB7E5F801E9D9D5A6F9B3EA802CB97588D4047FD994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59718c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59718c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3663799ca93a149f5c4f66cedf7228201821e4b6da4507438481901f2554e2ec
MD5 e37f5c5fca5575732fddad7f59edb7d2
SHA1 3f191d27f285f865e5dea16fe922b7aac37f5e23
SHA512 b05c4074bbfe8e2061e5f8fe0e332e36a9eb997bced8fe82553fee052e101fa9db7146476a3221770b8afc1eb4bc3ec9a73da75774d56df5a67e7d397fc40bea
SSDEEP 384:wtNn/s3n9SfsNXgItziP2be+CeODejhZW0fScjmwO:wj+9UMfq2OijhZWy1jy
TLSH
T19E928C37AE284D665EE39586F80736179F7840B3C6813F80D8EC6F0D01DBAEC1316929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 86ffe351bfd0a19173d6d70a38da78ce6c1a20b192369535484b0af117fac006
MD5 703f0caa0bfac8b32335b729b6b93345
SHA1 99b0ea05d0f5ec295ee0f2020a8a81d017713555
SHA512 085a90e50da87c5e0d29203560a97ceeda29671a117afe099c5063696e33c500d7bf4166287abde805bf5c0322ef2f2c5bfde787b0d72c6f4cc7457ae31bdc93
SSDEEP 384:xtNn/s3n9SfsNXZItziP2be+CeODejhZW0fScjmwO:xj+9Unfq2OijhZWy1jy
TLSH
T175928C37AE284D665EE79586F80736179F784073C6813F80D9EC6F0D01DBAEC1316929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 20175ea463dad2a40f65a69ee23d173622cd10ed0524731556b5ede7fbec7c28
MD5 00c9e51d15cdc91cb8e92b17c8df08d9
SHA1 0c498c9cf02964e55735bd6c3147a2e9f435740d
SHA512 be2a27cfcb6187d427c76d261364f0faa044975cbefe20f66d96546233788baa18c6f23d0b9eac4ec760271707cb3d42c000c659e777c58464a847efca7df95c
SSDEEP 192:JONj6v+YLNQmiUyJwZh+CGLOD9oqusZZU6:JONj6vz/fZh+CeODeMHU6
TLSH
T1F702D735BD281C7B9FF2AE45F98727175EA8117BE5952F80D9E82F0C01D769C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1c79ea82660ac12acc98c0c97d26c8d6b5bcd76bf00675a3b7da332cb1dc2f33
MD5 b12ca673db2e48ae70c55cb7cc22ffaa
SHA1 4812082b42299f62e9cb4ddd48d64c5ef28e0a18
SHA512 cb35764fda85001330064438378812fadefa418c3d75d1b88e8bf8b48edbf62f03419c88f36152e4c8c0d3afd36956d91585e2a64613edd163b0ad533714fdfe
SSDEEP 192:yONy6v+YLLQmiUyBw5h+CGLOD9ojhZTCH+qIfU6:yONy6vzBR5h+CeODejhZg0fU6
TLSH
T1F7120B36BD385C675EE2A585F58736135EA94137EA863FC0D5DC2F0C01DFA9C234A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d3955c0450bceea9953b84776b42ae05d301fdc7f1962fa5f06531bec52b13c9
MD5 363245839d35c419c3212ae1ef930ebe
SHA1 7e20afc0f05667ab9e4dc16e2696d0ac886b3101
SHA512 c19783cc9066b25cb64dfc77b9c1b15301444370b5f1052de72d526bcd985c5c2a29fd0182a9f8c7d4b7188b04931ae70b0b5ee383ac3858468a1876a762061f
SSDEEP 384:miF1tNn/s3n9SfzsNp8TUNTUlIlZItziPFbe+CeODejhZ10fScjmwO:NF1j+94cwgo8q2OijhZ1y1jy
TLSH
T16DC208F299D74936DAAE4747B73E2E128E7CC063B5812A80B7985E0CCDC61BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 afed76df7d6524ff9918d36b1d61a2cecc6271a3f79f00438660cc92aed75a9c
MD5 78644274aa9ad4cd926e16f4064170bf
SHA1 6a4cb191f7863efd4e108d6a8e59673f0f2303ca
SHA512 4b1c7312e6e3c55440c4517e175a4ff983750de9f4c948e945609f9b68c4e1d7110ee97b1dbd035bd2240228a257e15519771cebdd3c18b143b4e0b94ea22a91
TLSH
T19441E698ABED1148B3B76E5AAFF6A46D487F78772E06C49D10110D4E0A72B44CCB1B37
MD5 SHA1 SHA512 TLSH

Submit Download