hxxps://links-ire[.]support-helpers[.]com/Track/Check?gjOzCrS6ooW5Ha3uwqe6wqsbboWj8tznX6eZeV/64WkgrW1VjWBI18XR2809O5Ej2VMcWqCHRD9W/3wJUlDxdqPngyt2FaM9TTCVu0mDqWfEixREXia0TgiKBDNoZQAThtuT37I3+AFCd7UD1PcQ5s8jF5F7mMaTiN6TlUjRkw0=

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://links-ire.support-helpers.com/Track/Check?gjOzCrS6ooW5Ha3uwqe6wqsbboWj8tznX6eZeV/64WkgrW1VjWBI18XR2809O5Ej2VMcWqCHRD9W/3wJUlDxdqPngyt2FaM9TTCVu0mDqWfEixREXia0TgiKBDNoZQAThtuT37I3+AFCd7UD1PcQ5s8jF5F7mMaTiN6TlUjRkw0=
Sample260804-ma22hsxfja

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2052	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303122049330923"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{770340BB-0D7C-41BF-AC63-7B76512F6EEC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3836	msedge.exe
3836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 4460	1940	msedge.exe	87
PID 1940 wrote to memory of 4100	1940	msedge.exe	88
PID 1940 wrote to memory of 2052	1940	msedge.exe	89
PID 1940 wrote to memory of 4100	1940	msedge.exe	88
PID 1940 wrote to memory of 4100	1940	msedge.exe	88
PID 1940 wrote to memory of 2232	1940	msedge.exe	91
PID 1940 wrote to memory of 2232	1940	msedge.exe	91
PID 1940 wrote to memory of 4992	1940	msedge.exe	92
PID 1940 wrote to memory of 4992	1940	msedge.exe	92
PID 1940 wrote to memory of 2384	1940	msedge.exe	93
PID 1940 wrote to memory of 4992	1940	msedge.exe	92
PID 1940 wrote to memory of 2384	1940	msedge.exe	93
PID 1940 wrote to memory of 2384	1940	msedge.exe	93
PID 1940 wrote to memory of 4004	1940	msedge.exe	94
PID 1940 wrote to memory of 4004	1940	msedge.exe	94
PID 1940 wrote to memory of 4004	1940	msedge.exe	94
PID 1940 wrote to memory of 1204	1940	msedge.exe	95
PID 1940 wrote to memory of 1204	1940	msedge.exe	95
PID 1940 wrote to memory of 1204	1940	msedge.exe	95
PID 1940 wrote to memory of 1968	1940	msedge.exe	99
PID 1940 wrote to memory of 1300	1940	msedge.exe	100
PID 1940 wrote to memory of 1968	1940	msedge.exe	99
PID 1940 wrote to memory of 1300	1940	msedge.exe	100
PID 1940 wrote to memory of 3340	1940	msedge.exe	102
PID 1940 wrote to memory of 1676	1940	msedge.exe	111
PID 1940 wrote to memory of 1676	1940	msedge.exe	111
PID 1940 wrote to memory of 1676	1940	msedge.exe	111
PID 1940 wrote to memory of 4040	1940	msedge.exe	112
PID 1940 wrote to memory of 4040	1940	msedge.exe	112
PID 1940 wrote to memory of 4040	1940	msedge.exe	112
PID 1940 wrote to memory of 4440	1940	msedge.exe	115
PID 1940 wrote to memory of 2904	1940	msedge.exe	116
PID 1940 wrote to memory of 4936	1940	msedge.exe	117
PID 1940 wrote to memory of 4696	1940	msedge.exe	118
PID 1940 wrote to memory of 4696	1940	msedge.exe	118
PID 1940 wrote to memory of 4348	1940	msedge.exe	120
PID 1940 wrote to memory of 4348	1940	msedge.exe	120
PID 1940 wrote to memory of 3836	1940	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://links-ire.support-helpers.com/Track/Check?gjOzCrS6ooW5Ha3uwqe6wqsbboWj8tznX6eZeV/64WkgrW1VjWBI18XR2809O5Ej2VMcWqCHRD9W/3wJUlDxdqPngyt2FaM9TTCVu0mDqWfEixREXia0TgiKBDNoZQAThtuT37I3+AFCd7UD1PcQ5s8jF5F7mMaTiN6TlUjRkw0=
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x218,0x23c,0x240,0x210,0x264,0x7ff81ad6c188,0x7ff81ad6c194,0x7ff81ad6c1a0
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,14697291057922985428,10169567419065246577,262144 --field-trial-handle=2320,i,3581021363760117360,7096565707446587724,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,9754768710681197623,2056501444097668669,524288 --field-trial-handle=2320,i,3581021363760117360,7096565707446587724,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,11400537272640319267,6805435803442395156,524288 --field-trial-handle=2320,i,3581021363760117360,7096565707446587724,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,13621691527373437909,14414406269338258228,2097152 --field-trial-handle=2320,i,3581021363760117360,7096565707446587724,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,9550381901772182962,12756540843598101005,2097152 --field-trial-handle=2320,i,3581021363760117360,7096565707446587724,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,1555202190415588674,10746569685695431110,2097152 --field-trial-handle=2320,i,3581021363760117360,7096565707446587724,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,4005393422424936901,4527684027604460010,2097152 --field-trial-handle=2320,i,3581021363760117360,7096565707446587724,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,16159411913430783718,11364264872354858020,524288 --field-trial-handle=2320,i,3581021363760117360,7096565707446587724,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,7541393809515211202,8722276370694470313,524288 --field-trial-handle=2320,i,3581021363760117360,7096565707446587724,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,17213559580795404159,2664575088412885205,524288 --field-trial-handle=2320,i,3581021363760117360,7096565707446587724,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,17213559580795404159,2664575088412885205,524288 --field-trial-handle=2320,i,3581021363760117360,7096565707446587724,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4536,i,13028190561634957750,6126133923838944847,2097152 --field-trial-handle=2320,i,3581021363760117360,7096565707446587724,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6252,i,8749441026080383364,9791949929500441090,2097152 --field-trial-handle=2320,i,3581021363760117360,7096565707446587724,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,5087633192429685731,5956631306891001549,524288 --field-trial-handle=2320,i,3581021363760117360,7096565707446587724,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3432,i,3439947779274042574,2289170814275512422,524288 --field-trial-handle=2320,i,3581021363760117360,7096565707446587724,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,6350661646567219777,15174412036268553171,524288 --field-trial-handle=2320,i,3581021363760117360,7096565707446587724,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3040,i,14013809997834860853,15371714671791269191,524288 --field-trial-handle=2320,i,3581021363760117360,7096565707446587724,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,7757216942683018865,3125778246498952854,524288 --field-trial-handle=2320,i,3581021363760117360,7096565707446587724,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,17159378026370257779,10642199206936273843,262144 --field-trial-handle=2320,i,3581021363760117360,7096565707446587724,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1316ea4255a20e64750c2065f6bd44990544a6e919bb8583534091c8cfea6efd
MD5 9fef19324629b03bca48bc205d2b088c
SHA1 5a4edee278a3a2c94b55c17878c0e908c070d875
SHA512 9fe0b8a314085d13ad63c5f1584515138869af5c40bc9976a9a3c52608335eeeb921dd1e6c81630b95399f56861d0b90634e680637cadea3bd1c3ef18fe057cd
TLSH
T145712AB4012E26ACE7965F31C0DE42913771AAFAFD3B5F97DC9260FED9017604829038
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3cd836961887cc2916f12cc8b1c4162f819497f10f12857f6a2762308df9131c
MD5 0fb1727e58cdefeb795a6392eede1af0
SHA1 6147f0b0274af0cc27bc5ef4af83528e0dbee5ae
SHA512 a216f8681417df2ce050cde387db06d2e7f35a9559217f6072b0a0a1b6375cf9e455998c3a32d3ee404d5f5ae57b2173b65b89ccfd56639f6523fd57e6b8f2e3
TLSH
T167118BF3C7E1856ECA1116F06A28AE2BCE2D0501431C7C1589E8FF2B93F3475D10195B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 48842cbe9e704d8c6a0ccdf82a94ed6cdb0d98e49ec927e941248747cb890b28
MD5 420462d75d203792fbde93bf5ca48474
SHA1 68eef027849e3ece2b5a04f2307a165b9409eebf
SHA512 2d486bf07c7a018f22017a3fb68af48479b746b98c98ea3b46160f8dbf95cb1696aef418b64faea10339d6dccceb8663b913cfe03dddf554cc1d760cf1366395
SSDEEP 192:sxZc7RnyM/jK1Ml8MkB/fJsjXXVzIdpJHW6+WNGYvxr2KGwIgrJ:sxZc7rMB/fJsjXeJHbGLK59
TLSH
T10442D7116A346977CCCBD20DFA45BF93D6F91472A2900E44A9FCDA1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a56963d9ba893c4624b7e46cf01658f1a67c5faeb77297e4dc0c831a4bd10b1a
MD5 9af2709fc7ed74aafd95e60c4e71055e
SHA1 cb47fd1d3947bda0f2dad914bf040bd2dfc348fa
SHA512 5c8306aab9ba852c95bc810e7c00a78d3fdf51f49a2f55ea1d8e7c0cbae9f09a582bf470d6df0f6b41c0d86b6ffa581b78fd4455bfc4367088661020322ec6a8
SSDEEP 192:sxZc7RnyM/jK1Ml8UQNkB/fJsUfuVzIdpNOHW6+WNMcr/YvGW2aGwIg56J:sxZc7lqmB/fJsUfBUHbf/ra54
TLSH
T1A652D911AA345977CCDBE209F945BF53D6F514B291900E44A9FCDA1C04E6BED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b6ca2957898c667cfcc69239b6f11a8582cf775c8ccdc6746cae1a60e8b576ce
MD5 ac018df6ca5b18093d7e480c48ac4a65
SHA1 1254dbdc70e608394cc4ca37a7c77554a70228e1
SHA512 1bdfcae9011e0c473eefdc7688603686cedba2094382513980872dab2febdb4331d3612db1eaea2efae4f53c8aae3bf42060ba7ac7b6d91258efac997d5d397f
SSDEEP 192:sxZc7RnyM/jK1Ml8MkB/fJsUfuVzIdpHOHW6+WNMcr/YvOh2KGwIg56J:sxZc7lMB/fJsUfBuHbf/0K54
TLSH
T1B552D811AA345977CCDBE209BA45BF53D6F514B292900E84A9FCDA1C00E6BED2317C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d1ed6a934c51705b383aa9f4a401b9453e3d2cced9d342e3dbacc4eee7e5a6c6
MD5 c2c58600c875825a006ec5a1881716e8
SHA1 5575b84d6fe323ee234e01e1aeb0b64dc2795ce2
SHA512 e1f6817699e488a5cde737a5424f5c9e168792e5300618e6314cd52c41d1de95ca5cb646be34c788fac0c898a14bb31ff7b29a191ce98e996b28b9a8a61f69b5
SSDEEP 768:73seJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppQroSH:73seJ3xWvhfynu1jaVcL88p7K
TLSH
T10FD20B2B280CCB7E4F844E6CEC266F966EE801CB57984D5487EA984C03C77EB51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 c6128db1407fa70243ada41820c6567484e48e87b2b2f9cc9ff99f7653a46ce1
MD5 2550959a529e02db32a75b8a4710a3d0
SHA1 64655ad887866d8691e58a3510149bdb0182a566
SHA512 d58888de3b7cfee00f5bfcba770ee13a771cb2f3fc64ed104a3dc1830eaa54436e8b1615a4059ae637a1e33a22718da067f156b8bf18e744809aabef93c397b8
SSDEEP 96:KYH+KggmC8gKZWiKK0KrCq2JyKScBtcxtl:49TT33pj
TLSH
T117C11152343F02022C7E295CA2A39E368E4271A33414A4FFBBB900A55E67E151EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3f54260-dcfa-42ef-b4a6-ccbb218c272c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b3f54260-dcfa-42ef-b4a6-ccbb218c272c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 3489cb2002bd25ac1b4c967d73f46f1c4e7eba7f09ac0aa8c57a319a959ef46c
MD5 7cdb15dfa73f6b438b6aa9e7137b6038
SHA1 a7a1037d610a6042cfe93ec3582b2f071a3622ae
SHA512 2d430bc697db4331960a26347047736cd21fab4048b537a027066abe0c6a7ac7ec3f5a80499ac4c2feed8ce024d8b1243bf31324a8a36a26253efc46342cc829
SSDEEP 192:ukLsNKVQ2VU2vxjSM7uL8QmiU1nh74MTZS+FdLK7Fd3EX8z1tlkqaUMZ:hsNKV3BxD78MvkGdwdUctlIUMZ
TLSH
T1B5421A316CB4AC27ADA3B185F04A36439EB4517B9AC45F90E6ED6F1C01DA7AC2307D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 9765946a73393a7c0e5dc28965a71016f5724131b221e68db4cb5edc2b05a57a
MD5 0eec259723db14fac6b9f763e1c80a8c
SHA1 99bec5b6973ca4df812b4c91e205ddc3b860aed9
SHA512 684639595c1e31182cb9c6dba65206c440c9f12b7bf424937dcac364fc7afc81c4f8938c5f93e0bf3c05af97eba3bae0f9c214e3a5ed197ff4ab2e45baf5e462
SSDEEP 384:niFiZcI1zsNS8TUNTUlIld3BxD78MbkGdwdUutlIHq:iFQNfwg1xDBBUUutlIHq
TLSH
T1A2B20AF248D79436E9AE6747E77D2E024EBCD067B5809550B3D95A0CCC961BFC306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ef23d88d82759638b7c2885f4a4d78a20a558ee6e0dcfddb2949f91dd1d6dc1c
MD5 8144a23c7b1c886cbe47d937cbaf54c0
SHA1 7a4eaccc79a2d5845ed4f15db89d41e6d9967367
SHA512 82fc9c3ee99a984fbeca6c6e6a56a361fe0f81380cf802df668d7f8730ecd70007abd4f3e3461c891ba5388ea0e805f8bf37948510e2779751f086fa84fcd116
SSDEEP 192:lONnZ6vMtPQmiUy2jThTZS+FdLF847tlQSU/u:lONnZ6UtRtTFdJtlrU/u
TLSH
T1C4021835AC786C6BEAA3AD45F48A37175FA4217BAAD05B50EAE82F1C00D765C1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 5b3750605986d4372d33919a51023f1c76d393778a7bfab9971ae147f5b64246
MD5 c07cf53b04e12dff4a3f7acf35aa3eec
SHA1 45382d383c39e8073231eaee0ecedd460de3edfd
SHA512 40f8ea1fda967c756de5dc0820e106e92c4ae6c85fda6bb0865d77731a41944b6060cdd1380758534b2c97bc9d6ecff4dcea36e72dc2139f8415d774d6c067ec
SSDEEP 192:upm+xasuheOwQxMGsNKdQ2VU2vxjSM7uL8QmiU1nh74MTZS+FdLK7Fd3EX8z1tlZ:DZcIhsNKd3BxD78MvkGdwdUctlIHq
TLSH
T1E6627C715CB46C37E9E7B185F48A36038EF49037A6C45F90A5EDBB1D01DA6A8131BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 4bcb39cda44802ed5b7252bd452fb0fcd614547560e94808493376278066b8a4
MD5 959df473803e1e12b34c2c79c9728bf2
SHA1 ebff463b08059a1b2c8d25d3a195afd91ef96f1c
SHA512 a16f60e90a42ac89ec9ea315aaa83977d7a698e19a49b8c31bc512743161c65093ce5c49c37a18393047261358691918cd5a86be1d8033ebd933011752db569f
SSDEEP 192:sON76vMRPQmiUyCjkhTZS+FdLK7Fd3EK80ItlkqaU/u:sON76URRfkFdwdUTtlIU/u
TLSH
T1FC121A71ACB46C2BAE937485F08A36435EB4917BEAC46B90E6DD6F1C01DA6AC1307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 484B
SHA256 9fd2b7fae87c2d863b486a425834283f19b1444749c84650d5a48c9eadb12e2b
MD5 e9289cc1f579fdfa9d46acfae9b38330
SHA1 7eac8e241d8c35d873280d6b9dbc1cca7a9b2231
SHA512 b1f37da50e387c8408a960ef5276a51336510286c1db7eaea4cde65af4efc343f8ac1d9de65df1fd0818513823a485733e5c155da615344bc044f46021ecf586
TLSH
T134F0543C33D821A4F08C46B23596ED8B88BF313247DC2631CA50F550315387701B5095
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 435fe847d6517cba863ffa5d54c8ad2b0de8f30c94ade8c850ee2ac3ff726137
MD5 7b42ff5abbdd5b815448069f1e4bf452
SHA1 717ba916c405412a3c63d7c2f76d4535c34a7cc4
SHA512 93c4f2d6271ec3bf445bbb6d769dde9b7f3f6636a72885a2de3b8294f99e3822de5a58a897d1f3d786a55fec37018a0b0415c3207018c552eb132e996eec2398
TLSH
T10B515CC206D861BF69777BF04F01508D823F7B5EB299ECCF4890CCB5247785346910A8
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 49f8a65a092bfe3dcbe0729c51db6b0d38886e3e42b4b8b5169b1a7faafd1ada
MD5 5309a21c69916d212254269a63e759c0
SHA1 ee68eabb445d57883c01be57aab3ce8ec522d534
SHA512 0c5d7302cf4ba3863d4742e93919f47d32ea2a5e95b5ffc272de1eefdc3dfbcb9ac721ecac3cc740f068d7be20d201f2908cd64f31196568f1e94d323837b630
TLSH
T12E41165CAAEE1108B3B77F5A9BF6A46E487AB9771E06D46E10010E4F0623E40D861B37
MD5 SHA1 SHA512 TLSH

Submit Download