hxxps://dm-cn[.]aliyuncs[.]com/trace/v1/report?bid=202682&env=600000342511486788&extra=1-&mac=11723&mf=prod%40helixen3[.]com&msgid=v5[.]55164311[.]105668531440366[.]105668531429953[.]11723[.]1785600781[.]837[.]cnxmg%40helixen3[.]com&sac=0&tag=API&tid=task202682&to=stehrani%40amicogroup[.]com&tpl=&ts=1785600781&type=0&url=http%3A%2F%2Fv5zhui[.]realurl01[.]cc%2Ftrack%2Fredirects%3Fsign%3DMTGzlI28HF2qsfy5wLCSX0Pki2DLTGJ%252B%26m%3D105668531440366&v=1[.]0&sign=e8393700c4329a228e79a43a365b625c&urlts=1785600781

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
01/08/2026, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://dm-cn.aliyuncs.com/trace/v1/report?bid=202682&env=600000342511486788&extra=1-&mac=11723&mf=prod%40helixen3.com&msgid=v5.55164311.105668531440366.105668531429953.11723.1785600781.837.cnxmg%40helixen3.com&sac=0&tag=API&tid=task202682&to=stehrani%40amicogroup.com&tpl=&ts=1785600781&type=0&url=http%3A%2F%2Fv5zhui.realurl01.cc%2Ftrack%2Fredirects%3Fsign%3DMTGzlI28HF2qsfy5wLCSX0Pki2DLTGJ%252B%26m%3D105668531440366&v=1.0&sign=e8393700c4329a228e79a43a365b625c&urlts=1785600781
Sample260801-vc9hdatvbw

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5176	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300767332800084"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-101591186-421676486-4137282292-1000\{AC00F688-CF83-4EB0-99F1-0F9A28AC751A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4532	msedge.exe
4532	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5372 wrote to memory of 2992	5372	msedge.exe	83
PID 5372 wrote to memory of 5176	5372	msedge.exe	84
PID 5372 wrote to memory of 3232	5372	msedge.exe	85
PID 5372 wrote to memory of 3232	5372	msedge.exe	85
PID 5372 wrote to memory of 3232	5372	msedge.exe	85
PID 5372 wrote to memory of 2964	5372	msedge.exe	86
PID 5372 wrote to memory of 2964	5372	msedge.exe	86
PID 5372 wrote to memory of 464	5372	msedge.exe	88
PID 5372 wrote to memory of 1760	5372	msedge.exe	89
PID 5372 wrote to memory of 464	5372	msedge.exe	88
PID 5372 wrote to memory of 464	5372	msedge.exe	88
PID 5372 wrote to memory of 1760	5372	msedge.exe	89
PID 5372 wrote to memory of 1760	5372	msedge.exe	89
PID 5372 wrote to memory of 1732	5372	msedge.exe	97
PID 5372 wrote to memory of 1732	5372	msedge.exe	97
PID 5372 wrote to memory of 5868	5372	msedge.exe	98
PID 5372 wrote to memory of 5868	5372	msedge.exe	98
PID 5372 wrote to memory of 1688	5372	msedge.exe	100
PID 5372 wrote to memory of 5044	5372	msedge.exe	107
PID 5372 wrote to memory of 1204	5372	msedge.exe	108
PID 5372 wrote to memory of 5188	5372	msedge.exe	109
PID 5372 wrote to memory of 4600	5372	msedge.exe	110
PID 5372 wrote to memory of 4600	5372	msedge.exe	110
PID 5372 wrote to memory of 4600	5372	msedge.exe	110
PID 5372 wrote to memory of 2128	5372	msedge.exe	111
PID 5372 wrote to memory of 2128	5372	msedge.exe	111
PID 5372 wrote to memory of 2128	5372	msedge.exe	111
PID 5372 wrote to memory of 1108	5372	msedge.exe	112
PID 5372 wrote to memory of 1108	5372	msedge.exe	112
PID 5372 wrote to memory of 1108	5372	msedge.exe	112
PID 5372 wrote to memory of 2120	5372	msedge.exe	113
PID 5372 wrote to memory of 2120	5372	msedge.exe	113
PID 5372 wrote to memory of 2096	5372	msedge.exe	114
PID 5372 wrote to memory of 2096	5372	msedge.exe	114
PID 5372 wrote to memory of 2096	5372	msedge.exe	114
PID 5372 wrote to memory of 4532	5372	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dm-cn.aliyuncs.com/trace/v1/report?bid=202682&env=600000342511486788&extra=1-&mac=11723&mf=prod%40helixen3.com&msgid=v5.55164311.105668531440366.105668531429953.11723.1785600781.837.cnxmg%40helixen3.com&sac=0&tag=API&tid=task202682&to=stehrani%40amicogroup.com&tpl=&ts=1785600781&type=0&url=http%3A%2F%2Fv5zhui.realurl01.cc%2Ftrack%2Fredirects%3Fsign%3DMTGzlI28HF2qsfy5wLCSX0Pki2DLTGJ%252B%26m%3D105668531440366&v=1.0&sign=e8393700c4329a228e79a43a365b625c&urlts=1785600781
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffd9011c188,0x7ffd9011c194,0x7ffd9011c1a0
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,6150416948620756366,2323501722123749472,524288 --field-trial-handle=2336,i,13585694730508783200,15723180466522753135,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1900,i,14401718556372925122,14282287748663600138,262144 --field-trial-handle=2336,i,13585694730508783200,15723180466522753135,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,16549683549162142108,5138347489226657112,524288 --field-trial-handle=2336,i,13585694730508783200,15723180466522753135,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,12719461311051370158,8248905932862782800,2097152 --field-trial-handle=2336,i,13585694730508783200,15723180466522753135,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,1755724689846341941,16085546658854712098,2097152 --field-trial-handle=2336,i,13585694730508783200,15723180466522753135,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,17143166136475374917,28326599492950989,524288 --field-trial-handle=2336,i,13585694730508783200,15723180466522753135,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,17601976243704370378,9640677510134638363,524288 --field-trial-handle=2336,i,13585694730508783200,15723180466522753135,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,8470663050542530193,4679902718806046027,524288 --field-trial-handle=2336,i,13585694730508783200,15723180466522753135,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,8470663050542530193,4679902718806046027,524288 --field-trial-handle=2336,i,13585694730508783200,15723180466522753135,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,11652599867325347813,8237533548446022193,524288 --field-trial-handle=2336,i,13585694730508783200,15723180466522753135,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,5338750587564541844,16033043234404906706,524288 --field-trial-handle=2336,i,13585694730508783200,15723180466522753135,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,5797981756712442952,2770582114523095614,524288 --field-trial-handle=2336,i,13585694730508783200,15723180466522753135,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6084,i,1746251458068549741,4893356813318434223,2097152 --field-trial-handle=2336,i,13585694730508783200,15723180466522753135,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5308,i,13140551309697127569,12484902001219897116,2097152 --field-trial-handle=2336,i,13585694730508783200,15723180466522753135,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4844,i,125916833353579830,1349805492353700159,2097152 --field-trial-handle=2336,i,13585694730508783200,15723180466522753135,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,6107734096055809445,10670828300757684677,524288 --field-trial-handle=2336,i,13585694730508783200,15723180466522753135,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5292,i,4265443807727383357,8419385178925275815,2097152 --field-trial-handle=2336,i,13585694730508783200,15723180466522753135,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6024,i,17051655526316292385,8054246660054307717,262144 --field-trial-handle=2336,i,13585694730508783200,15723180466522753135,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35cc5409a0e92c7b1f173401d1114c9d5fdc977752a8e45ce9068d8101c9a651
MD5 4177a98ec95c7b8511089a1be66e9e7b
SHA1 523d632928047252508b7d45169327ef4523179e
SHA512 d9e67625f1cfcaf9b90149a3ed0ce8899f43e93e14c729f7cf114adedf8a6a345c93240cebfa58351038924578a437d9d7144c7dcd826b1b8892dc523920e947
TLSH
T17AD08077670FF411E36D5131D503C75117AE547179625723F118C40D99741D693C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e9b606cfbfc7b0fcbfab1ff9a90d94ddcf0c4033903cc47f13cbcd8bcac95cc
MD5 66bd1dbef8b4df50e7a09a2d2848fb79
SHA1 69983a576369225e69f3c4e38eef011e7e436249
SHA512 7f8546014287d3ced2b59766b273c8d8981aee3ef643630332615e594a89f92a95f1ce112c2fa889b0e249a10643792bfc57043bfc523d6ada97b8bc7d6e7d6c
TLSH
T17CD080776B0BF411E35D5131D503C75127BE507179625723F158C41D99B41D697C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 347191a82c00ca22dbc0843de8797f1f87a82fc9cdc9af3506b380d1ce46eeba
MD5 1399cc42d044d8eade36455a6a4451ee
SHA1 4591eb4c1b908bc091b79551c1bdcdc5d784bfac
SHA512 eb34abe2ab3fa8d7d5549e96517e9f4969387ba5d1be7405ad4f281900e9e335df198dcc7e868f5e6330d499df1abf10bfcace02ff6233684b74a3b8e62a0ec1
TLSH
T14AE0E5E9C932AC2708FC171C64154A86D64003162A81496B3B3DA10D8FB1637169685C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a8dbee5a66d60acf1863a790bfcaa83a6032119f6069ae797b027be21fd0ca17
MD5 2601f9c987405dc5ec8f5ff898df98af
SHA1 bedb1c7817752bf4224185c8f2b1c21db1effcc6
SHA512 2f2dbe00c7ed7b1c62dd40c5edacaa193bdc957c3cde0fbf59e75c2f4299d9eaaba34e27a02e9f6067126fa892bf01c458b71103ffe5a4b2171cb1e01c2e3381
TLSH
T10581C6A95572C4D2E794C1BCE0DA9DC236F8827756039FE70050ABF5369EBB011DD14B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a7c198b5e80f0232236297fd937493e675b3abdf223b8f064fffb6951e8311c0
MD5 6e4505c09f3c7c0c3a530ac4877bc4de
SHA1 1ca4f32d13b56d0ab67b40fbf3e45a3eea6ccdd5
SHA512 6c6399ced2c99a5a9b1dfc3e9d9daeed962b2a72db3f1942e7b18f5fd8be97d6dd8ee35bff9135c21c9a571b1a845ad2a9fe5da27167eddb368c7a9dc21c905f
TLSH
T1DF71746911B2C4D2E751C1BCA0CADDC576F886B656132FE200506BF536EEBB111DC11B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e8c5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e8c5.TMP
Size 3KB
SHA256 d355d40bd3bc23c70ec486c6eae244e0c759ac9c7e8ba20785329bae0ea1baf7
MD5 01c2461911769c0c5fcd4b68c6d9f15a
SHA1 2ecf21f89a2744e5fb562203ef6eee3169833c26
SHA512 520676ddfcfa6d78cae6a310a708f1cb6808a0d408820540db581dc8cfbc097bef20191a1fb194fbb6c661d2a695e6728f088e546491ffa23839a101a51e9744
TLSH
T16B71A56921B2C4D2E751C1BCA0CADDC57AF886B656032FE600606BF537EEBB115DD01B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 ddffa6a9a8d478f3e60085dffe4f7bbaa4eeb0aaadf252a8e7c1a7a11ad44ddd
MD5 7694d3d51198d9a1f24ed57ff60ed10b
SHA1 d2da262c6b627f81ebd94b7654656d74cf064ac5
SHA512 92ecb56f02be903186754edcf497ae90fba5360db5151aebf563353c7984d5c6f07a3b61d6d5cd28b527ef69d59d621128e74092800c60f57348fba15d06ed35
TLSH
T1CB718BF787F5852E8E1296F0BA14BE1BDE1D0225532C3D6985E4AF16A3E2471F002A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 95ccf19f8ef69c3c73efda0dbc7169b206a76f53ae7df5b02be775b6ddbf0eaf
MD5 1af5067210a392605fc144725cae7248
SHA1 612183855d5a4bdacd46d7328a4b6da4a1d60ba5
SHA512 e0c8c55b3701a64b92b88c695b422b1b7c409bc324f74ed026a7c1570ef31cd54e51c3885c8e847e9aa343b260c18d09fd90c57c6aabbdf79c028422869a3791
TLSH
T1C441AEF783F4856E8A1196F0AA18AE1FCE1D0525432C7DA985E4AF1793E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 1f0f7d0732720fc4a7c37ae552c1a573da139cb6bd3dc7b7561b2e6f674f0139
MD5 66c22a0a8251e70442585ea30944db93
SHA1 553cea87542f25219fdda122934adc5e40d6eaa5
SHA512 994063a01dee2c505ef084c92515f19dda4a4184bcc9d1359f377b0f83a3e18caa2b67b62c947448262b04bf02b91c0271a411336abc560268008c688e3bd66f
SSDEEP 192:sxZfRvyMqZjK1Ml8UQTkl/fdsdQ8uo4rgnzodpUh3HDc/6+WNWJcd/YXTP8rPFIE:sxZfEq4l/fdsSLH6HPp/S6RLzd
TLSH
T14472D6056934997BCCDBD219F585BF93D3F9446391904E48AAFCAE1C00E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ff305bc372edb0db3b41726c32c3b77fd33638842ee84bdbf8f7a46a8d46167b
MD5 a52d5a7c4e7bb62cbd28d6c2b56ae281
SHA1 f6abaefb2190b327e8823a51f5b7ffd1475297d5
SHA512 2bb6171bc22620061b1e6a077ef85de974e69a8745a84a2da75d94f878960d00144c55c1dd81a8d7256d56f21f2e089574189b799f15ac63d144009531fee6d2
SSDEEP 192:sxZfRvyMqZjK1Ml8Mkl/fdsaQeuo4EgnzodpLHW6+WNGYXDr8DPFIgjLJ:sxZf0Ml/fdsDdaLHbGC6Rjd
TLSH
T18662FA156A38997BCCDBD209F9457F93D3F9446392904D48A9FC9E0C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 92e5f4757d0ece56c23af6a36c41ee515ec9daac50777a6286745de905f1bfd5
MD5 868f2433c6cbf2da699ceace45273110
SHA1 01eadb62ce1ee618490b0832256f3ea517985049
SHA512 2dd62834c746f20b3da82610dce8f10a4256ac3fa5e2ed44df71a96870e77a0a0d2782a9c399a72a640093b5b41011d128bc2a2cc64f201962da4fc1e5a3fbe3
SSDEEP 192:sxZfRvyMqZjK1Ml8Mkl/fdsdQ8uo4rgnzodpUh3HDc/6+WNWJcd/YXTP8rPFIg5P:sxZfEMl/fdsSLH6HPp/S6RLzd
TLSH
T19172C6056974997B8CDBD219F585BF93D3F9406391904E48AAFCAE1C00E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 33a391965bb825fae1d2497f21874e02decd5b8ff9cdf8aebc5e72f48bfeb07a
MD5 f507ff5bd5c06654fcd9e4a6ca28d6b2
SHA1 a6187c5652047c7037e91a584b1ca96d7dade399
SHA512 3e724b626826c7c781641fa2a424bc9a18388d5a8173091a2139547486c15caa5137487bd38922f981006881decfd8ac7a5b0db4c5c85de6a406a6263478b5dd
SSDEEP 768:/Zk4PXDWvXt4h8F1+UoAYDCx9Tuqh0VfUC9xbog/OViiLl42vJ4roWpN1Z4STU:/Zk4PXDWvXt4hu1jaHiL+QJDWpah
TLSH
T1D0D21B3F680CCB7E4F844E5CEC26AF966ED801CB66988D4447FA494C03C77EB521A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 f0dadde4a9ccb6ab021046216e101f6eb26446dc157614d2e158bb1efcbb3dc5
MD5 c6be0a812dd8fc7fb9ee4d868c634913
SHA1 a53bc43b0396188986bcad75992b2925a18bb202
SHA512 a7a5041616303df6d7dc6414ba40f45e456d06cc701189c55232a8b4dac04ec3a8912421ece3b623949e3da7766cdc06336bacd90a59bbf2d26074e58737f4aa
SSDEEP 192:EtjGz7Y1/St59NZp1ZVzDqHgnmz3th9AZkzPr1PVIfPU1orH8:EJGnYNSv9PpHV/qjqb8
TLSH
T123B21B13313A03423CBE2909A2B686779E4231B33019E67F77A944A64E67E124DFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 161d9ca1a4c74abf2d6664e22a5aa94c90c216eaefc6d25a84e54ad721c90376
MD5 677f50542f04b97c85762697d3ac07ef
SHA1 47d0dd9c4195ad45b845f62bd2c7423492f469f5
SHA512 d239445ed11ab154f03e7d035ff4ce239779304769d1853b2b5d0b4daaa72b8c612e126b88a207a62e9bd1e94aaf9cef05f5f8ef40d9ce7562553c207105e409
SSDEEP 768:/Fccps3swgljldVtiQUUzQ61hkoFYS/Pd:ns3g2FUzQAhkoa0d
TLSH
T1A3C25B32EC94CABBEDE64BD9E74A3A03DEE04267C58C99D4DADC1D1D00DB19D130B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 307d140c8a063df3ffdf8e5ad00a83bda5dc77be9d4cff2133b8dbec931d0140
MD5 d469d33381fbe9f657164e599d82ef67
SHA1 2acc72117b8e5bc36d109d33c5fc73c7f9016466
SHA512 356b9f277ff330c0144c18ba267873027755adfb9d48db557a74eca792b2bb55ba7f7acea0bb451934bc93cba69bcc7a3e6256d3ed14b3fcd53177d36faa18c6
SSDEEP 768:mMFccps3gwglqlvVtiQUzQ1yQhkoFYS/Pd:mMs3ENFzQ7hkoa0d
TLSH
T1DAB25B36EC98CEBBEDF74F99AB4A7A43DEE001A7C58899C4DAD81D1D00D719D134B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6faa68eda58b4c34b044988527f8e0a6aa041e0512919cedcc18e2c35fd4629e
MD5 d4fee498a905496d3cd9f64f29bcd34b
SHA1 d7c76147952397c738a4d90cc185c4eeecebb34a
SHA512 93ffc32184fc52df52efd6e421b863f3e999b239ebf2004509a9e75bb83573510c526ff9ff4b852eeb37690a9a42fb0b1bc5928a986d9925de218c9802520871
SSDEEP 384:nBiFiZcIF3sNT8TUNTUlI4kqzoNmFtgyBfgVtiQUTGaae0Qg1nTKwBODNZOCxHyg:oFQF3cwgI5KVtiQUUzQg1newBKZOW
TLSH
T10FD25C72EC64CAB7ADEB8B89B74A7603DEE04163D58C5AD8E6DD6E1C009719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 df1bd5be4ccb11c31eed4b4dfd74674250637669a42427d10f036d063bfb2993
MD5 8d688f9c257949eb592ea8df8cb37bb8
SHA1 4fe344f25909e44d176e6711e22fe4669645d762
SHA512 a6736be9ffdab54256f69661304f52b8530e2c74f85b98225179b1a09066e97aff6a812a84c9eb75b1a7dc482f0ff50f63d5c682a880dddd0c895fc925d3d092
SSDEEP 384:nQiFiZcIF3sNT8TUNTUlI4kqzoNm9tgyBfgVtiQUTGaae0Qg1nTKwBODNZOCxHyg:rFQF3cwgIpKVtiQUUzQg1newBKZOW
TLSH
T147D26C72EC64CAB7ADEB8B89B74A7603DEE04163D58C5AD8E6DD6E1C009719D030FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 ba5746f0e80a0cf86b9fe79da4d0352075c11b177b4628a1dd830bf302282f36
MD5 ed8e8bdc9d16e5348c0459b7fb1f39dc
SHA1 512bfff66954584458a3ececa700d65adb3050d6
SHA512 770106963270866192f66447d261a20cc9e041d3135992763b1640d540714bb9d96e2a763dcd9d32c7bebe636f47e856adfd503bc1718826fd2a623541d6f5a7
SSDEEP 384:nniFiZcI71sNT8TUNTUlI4kqzoNm9UgyBfgVtiQUTGaaeZ1nTKwBODNZOCxHy/7E:iFQJcwgIwKVtiQUUa1newBKZOW
TLSH
T1ABF2D3F198D78977E9AE4B87A73D2E029AFCC153B5885984B7D85D1CCC821BFC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6d8c62c9e9c31dcb1980cc86c5b27f9c96148bc60c5c23dc58b416db887c4c84
MD5 e33567d5868a6c1a3a547ffd4888e626
SHA1 d87f249687044195ccc507b663bc535482f67431
SHA512 bccf38f5709866d41d7620de1e1b9d96ebe6b888570bc11688555c5a4464a70bc15ff853f92a24afb20fcd364e670264f389d8fab2700a9cd7f8b8679c3dcd7d
TLSH
T13C411A58B6F91148B3B76E56ABF6686E887EBD372E06C49E00110E4F0A67A40C961737
MD5 SHA1 SHA512 TLSH

Submit Download