hxxps://www[.]metrocuadrado[.]com/cas/logout?service=hxxps://WLwq3Nur-TLSE--[.]sitefirms[.]click/r/296849#YmF5YmFycy5jQGFqYXguc3lzdGVtcw==

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 14:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.metrocuadrado.com/cas/logout?service=https://WLwq3Nur-TLSE--.sitefirms.click/r/296849#YmF5YmFycy5jQGFqYXguc3lzdGVtcw==
Sample260916-r6phhsbd52

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL 3 IoCs

phishing

description	flow	ioc	pid	Process	stream
Email address	37	[email protected]	1452	msedge.exe
Email address	42	[email protected]	1452	msedge.exe	1
Email address	58	[email protected]	1452	msedge.exe	5

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1452	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340437714816642"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{F8D912DE-5FD7-428D-B4CE-8F7346DC2509}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3940	msedge.exe
3940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 3492	1404	msedge.exe	88
PID 1404 wrote to memory of 1452	1404	msedge.exe	89
PID 1404 wrote to memory of 2124	1404	msedge.exe	90
PID 1404 wrote to memory of 2124	1404	msedge.exe	90
PID 1404 wrote to memory of 2124	1404	msedge.exe	90
PID 1404 wrote to memory of 1564	1404	msedge.exe	91
PID 1404 wrote to memory of 1564	1404	msedge.exe	91
PID 1404 wrote to memory of 3088	1404	msedge.exe	93
PID 1404 wrote to memory of 3088	1404	msedge.exe	93
PID 1404 wrote to memory of 3088	1404	msedge.exe	93
PID 1404 wrote to memory of 3080	1404	msedge.exe	94
PID 1404 wrote to memory of 3080	1404	msedge.exe	94
PID 1404 wrote to memory of 3080	1404	msedge.exe	94
PID 1404 wrote to memory of 4276	1404	msedge.exe	95
PID 1404 wrote to memory of 4276	1404	msedge.exe	95
PID 1404 wrote to memory of 4276	1404	msedge.exe	95
PID 1404 wrote to memory of 3356	1404	msedge.exe	96
PID 1404 wrote to memory of 3356	1404	msedge.exe	96
PID 1404 wrote to memory of 3356	1404	msedge.exe	96
PID 1404 wrote to memory of 4108	1404	msedge.exe	100
PID 1404 wrote to memory of 4108	1404	msedge.exe	100
PID 1404 wrote to memory of 4108	1404	msedge.exe	100
PID 1404 wrote to memory of 4720	1404	msedge.exe	101
PID 1404 wrote to memory of 4720	1404	msedge.exe	101
PID 1404 wrote to memory of 4720	1404	msedge.exe	101
PID 1404 wrote to memory of 4332	1404	msedge.exe	103
PID 1404 wrote to memory of 4332	1404	msedge.exe	103
PID 1404 wrote to memory of 4332	1404	msedge.exe	103
PID 1404 wrote to memory of 4572	1404	msedge.exe	105
PID 1404 wrote to memory of 4572	1404	msedge.exe	105
PID 1404 wrote to memory of 4248	1404	msedge.exe	106
PID 1404 wrote to memory of 4248	1404	msedge.exe	106
PID 1404 wrote to memory of 3120	1404	msedge.exe	108
PID 1404 wrote to memory of 880	1404	msedge.exe	113
PID 1404 wrote to memory of 4912	1404	msedge.exe	114
PID 1404 wrote to memory of 4236	1404	msedge.exe	115
PID 1404 wrote to memory of 1568	1404	msedge.exe	117
PID 1404 wrote to memory of 1568	1404	msedge.exe	117
PID 1404 wrote to memory of 3940	1404	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.metrocuadrado.com/cas/logout?service=https://WLwq3Nur-TLSE--.sitefirms.click/r/296849#YmF5YmFycy5jQGFqYXguc3lzdGVtcw==
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff8f606c188,0x7ff8f606c194,0x7ff8f606c1a0
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,6454797937343274,3622306920105678538,524288 --field-trial-handle=2044,i,8632106830824757499,4712752049690038104,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - A potential corporate email address has been identified in the URL
  - System Time Discovery
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,15571004172744283548,2226581925041032102,262144 --field-trial-handle=2044,i,8632106830824757499,4712752049690038104,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,9748889676374457959,5759427006865545345,524288 --field-trial-handle=2044,i,8632106830824757499,4712752049690038104,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,3502933691366364036,12317991296092045023,2097152 --field-trial-handle=2044,i,8632106830824757499,4712752049690038104,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,8129976429336161806,15291805019311634208,2097152 --field-trial-handle=2044,i,8632106830824757499,4712752049690038104,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4116,i,8200826557960370150,16439543505066898748,2097152 --field-trial-handle=2044,i,8632106830824757499,4712752049690038104,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,12476428112056664081,6038096117371376208,2097152 --field-trial-handle=2044,i,8632106830824757499,4712752049690038104,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5008,i,8419659861947644795,12880384565008261590,2097152 --field-trial-handle=2044,i,8632106830824757499,4712752049690038104,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5176,i,364002696888098855,7794660100834464747,2097152 --field-trial-handle=2044,i,8632106830824757499,4712752049690038104,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4168,i,4814248305896967424,6372893026701622052,2097152 --field-trial-handle=2044,i,8632106830824757499,4712752049690038104,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,5503773210062203217,9020885216358137915,524288 --field-trial-handle=2044,i,8632106830824757499,4712752049690038104,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,4327215015767350957,14179901276096107166,524288 --field-trial-handle=2044,i,8632106830824757499,4712752049690038104,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,13624125981063285881,12641324630766740127,524288 --field-trial-handle=2044,i,8632106830824757499,4712752049690038104,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,13624125981063285881,12641324630766740127,524288 --field-trial-handle=2044,i,8632106830824757499,4712752049690038104,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,13729880467404421717,1113794993942727770,524288 --field-trial-handle=2044,i,8632106830824757499,4712752049690038104,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:8
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,10866481168666887703,2759131681564556415,524288 --field-trial-handle=2044,i,8632106830824757499,4712752049690038104,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,11460778465056659905,17058019961265952019,524288 --field-trial-handle=2044,i,8632106830824757499,4712752049690038104,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,14008982355170116029,3543727739614219862,524288 --field-trial-handle=2044,i,8632106830824757499,4712752049690038104,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5432,i,5302879744394370553,12095758447987937180,262144 --field-trial-handle=2044,i,8632106830824757499,4712752049690038104,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a9e2856f7b8bdcf4e651903050a9f78a4dcadbc91b2bacca38c04067256642f
MD5 8eed843072749c683b08c3e5dbce9bd8
SHA1 87464a0b34e45a134ed6f01b613378b3b1c952ad
SHA512 ce7dc7d95703c8a1e763fcb3eae4091d89a746632583bc1fc73a8c189a11f08c6f50e2ee328053aab1da82c11d6f5f81942259c5654861d13f267c34e76feb7c
TLSH
T199D02B6CBE989EA0E40210340231910431CBC8178442200648B1065708003C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 221e3dccb30d516b1b3c2d51c604a308dfba3aa3dbe8e11c2d09e185e21df465
MD5 7c97d945db36fde78f76660ee3165916
SHA1 fa851b1197f5a5f6ba4d935baba30b0465e8ad12
SHA512 73a256bc0b95a0662925ed2ac0e1668d7a760da5001e2b32fe139724419020254e080420b21ccad1896c60c44ca2663c2a3d2eccb8cb4180b6b0ad628c68d676
TLSH
T14FD02B6C7ED89EA0E80210340230910431CBC8178442210748B1065708013C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bc17a2e2b0265f1fcba7b31ddceffa7998550817bebd07cae54a049e69014f14
MD5 cf9138ed0d4c3a1aaa4729826fce029a
SHA1 20f12bab9f2d0eaf68df0e6093dd125b2a789a1e
SHA512 f7070a1abc05e2334e2fabb64b7506306438f942711690334eb846ff7bc3a756ce00fa80181ed82f3cd72f4a6129f80b61aa132eb3997f2545da773ef3e30ef7
TLSH
T1BB716F4BC5B34263FB8897F185E12587BA7B7E821A931D1E11A8E475844FB374C161E0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ad7c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ad7c.TMP
Size 3KB
SHA256 2f92eef68522067e28cb7a3fef6b37d627d50a6c3ddc9df5c5e68431d2ef9bd6
MD5 7db9df09a07c6656df143786c6b0e342
SHA1 29b32e2fa01b84b560f7da3e60cd0e716bc2f58c
SHA512 440b89680c2129ac694ff388f3567649f2050ba72f24bf918305bbc12e087d31aa2fbeb75c4d4557464cd2789fcc66586c55874c09dbf79079ef015bc4ece3e2
TLSH
T1E4613D4BC6B34263FB9897F1D5E42187BA3B7E821A935D1E11A8E479444F7374C151E0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 92593596d6115b849ec7b075defe778340426b35a382467a86ef46edcc196460
MD5 d2d296a28f9214be1aa2c83bbea05c30
SHA1 02aaf77b19121ca7cac91e74a050df486b5dedc1
SHA512 c5fa87ac9ebb5f934b2aa328b70d7c1b99bb18b72eb1c94f848d3ca66f92d500273ef6c275c286b040656c097c263f9bfe2436409ab4cf3e4734cf7419b2a462
TLSH
T1DF41CCF7C3E48A5ECE1156F0AA146E2BCE2C0956425C3D19C8D8EF5BA7F30B1E10264B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0f9e69a644ea525a1a0c5a5b56f0d6ac76ccfa070a0022af26f0fc13b037fb64
MD5 6c0dc2b069a58069af4d2eac1b6de9aa
SHA1 255c043ab81af2076a6bf82b1e16ad10b13d5720
SHA512 e8dd8dd7b2b149ecba3b0f17e96733f51cc790b14dff055c44147e5ae904ae95c8f9bc1e1c7b941a2574cb8bbfcf8639d353864d7d3463dc8f8cd4ae58e7cdba
SSDEEP 192:sxZZTRSNW9/fTsXvIdpJqyGHW6+WNpQqklK/Y3il+pIgrJ:sxZZTP9/fTsXA6Hbp5/jo9
TLSH
T1D022C7567A38597B8CDBD219BA25FF13D2F9503291D40E58AAFC8A1C05E67DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e08ec2fa4b5b8498a08d940b13d87c3e029daddde2079f966a96aecc3e451892
MD5 df698045dc61f972f01e94c435cdbf46
SHA1 efcf24c917e475c528a3945958dc2fe502b3c67b
SHA512 9248818772ede24f4276abb1a2213175999c295dd50f92a676666cbf3a29eebfd1a7077229bb92d7e3dfaa32c86764028cdc2ead82dd9967ad9086b89f7eca08
SSDEEP 192:sxZZTRSNW9/fTsVHIdp7zyGHW6+WNpQqklK/Y3Xl+pIg55J:sxZZTP9/fTsVIFHbp5/eo9
TLSH
T1E532C7567A38597B8CDBD229BA15FF13E2F9503291D50E54AAFC8B1C05E77CD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 91c20dab0aee2a27262b4f559e0df3ede998c8dd53fb4e7c5bf98ff61012667c
MD5 5d6d1fa0ce0d67be544518ccba416ce3
SHA1 0ba87e8622f7e619cf160dfa1ac28bed22abc172
SHA512 ca7e2884c7f1c739137b81279434db8a1c670402a040bf6305be641ff12222809dab3b357423e103de1560ad929bfe31d9ebbb9304316144d749df51bfa3a975
SSDEEP 192:sxZZTRSNW9/fTsVHIdpJzyGHW6+WNpQqklK/Y3Al+pIg5bJ:sxZZTP9/fTsVInHbp5/7o7
TLSH
T13532C7567E38697B8CDBD229BA15FF13E2F9503291D40E54AAFC8B1C05E67DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4838baa34347cb64267b141d8a6457545fe80cec06e760705ae068288449288d
MD5 ed1eccb82657aa260ed8babb515e528d
SHA1 f64688e22e99ccc27e4e75ff39302d4d0793cab0
SHA512 5c931d1f345755ae1f59aebc918b5efc636da914631dd21643b92b4cf5aa6d088bd25265e1c0f0f313635459e7ae1132c3bb4f00f1c0a7061de727b7fcf71d23
SSDEEP 192:sxZZTRSNW9/fTsVHIdpJzyGHW6+WNpQqklK/Y3fl+pIg55J:sxZZTP9/fTsVInHbp5/oo9
TLSH
T11832B7567A38697B8CDBD229BA15FF13E2F9503291D50E54AAFC8B1C05E77CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 62b850eb58fdd96fc82bb47fe37e2cf9c01fe3bda379133a7600d8b745c9a384
MD5 d6b214c1aeba6b38f31f2a63aa6348e7
SHA1 a15838dd7a5663c9c445b6d7c44b4831b14dfcb0
SHA512 6b9e047431033e1be637a1545ab2c7e5e00287bc13f61ee652f281ce1002a352ddc24f2490d5634534f5052197712ce8ac03aedb12dc57c7561a99b9ced9899c
SSDEEP 768:tf30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72SrolZMe:tf30AbSWvS2l9u1jaLmLZ12Jd
TLSH
T1FAC2DA3B640CCB7E4FC05A9DDC6AAF9B6E9C02C796648D4047FA984C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8f54a6e33908e9de80f5f1e1d4a9c01c3283317daa431a5b34987ea8db984b85
MD5 5735cb6d62790be1b6538c4e5c2051ca
SHA1 4c50b8cdb2495b32ab95884c42bd334a5469c5fe
SHA512 f1f299e54d2dc9e8fd26735077cc3ebb0d256bf730a4618f2e59c9cd2cc47bea3cbcf46fa342e97df1d19f5831c181d7341a086ec509ec1a6f73e47492c8c51d
SSDEEP 48:KgHIdK0UInyxQIfK9+8hwIDKxqU3ydMoMLMqMWMoMaMK:KgHmK0UqSQgK9+2wwKxqGhpY/jpPK
TLSH
T17991F10131BB024139BE251985BB8B2E024275B33119FA2F7BFD44E29E67E591CFC8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59df3b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59df3b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 61b8cc699b3ca2d1eda95921a975fd75b04586f1be04e0b44a7260585d9d8fcd
MD5 ee70383326ace96fe1819f3cf5384949
SHA1 2eec0e73ced4d90e6d3f609c1c68f8a8b4b651dd
SHA512 4dee582ef15884acbdc9a89e97ce97ff434fbf78ccdc9a2cf584188b49a971887a73b9efc4cba71b261cd92c86d4168d057a732ff0059928d6d89941b2110e23
SSDEEP 384:jZcIgsNsU6Di1pu4To9iX5FC/8TXX1i+2ES7O6R2Feoyh7UQoZ:7gE3sauMclES7TRpJO
TLSH
T192827C3268789C3B59F2E265B44B3A139FF94067D7CD1F94D5EC5B2E05CA7A8130AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2327ad0cd6b17fad130f8173d39500397e8df4c3c7228f235d57edb7f325f7e6
MD5 870e153917c2aa653f456b3dad5883d4
SHA1 0a48562ce7c5449f77455f89475b52a92c422858
SHA512 54be83c91c3fcd3356295cf9290519816b3a29b9ad631b54dbb5d7e3556b522d3b8514ddb56d73a1a0034939e6b93cf19e2350072bdfb00656d7fc3559f14fda
SSDEEP 384:tYiFiZcIVmsNt8TUNTUlIl6Di1pu4Qo9iX5FC/8TXX1i+2nS7O6R2Feoyh7UQoZ:tjFQ8wwgN8sauMclnS7TRpJO
TLSH
T16CC22AF258E7883AD9AE9753A73E3D028EBCC053B5855A50F3985A1DCD862BFC306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b2c4921473a299afba876cd4d7eaf1f495f100b8905c377743c10892b3a23ef7
MD5 2cc8d829ecaeccd9dcac5e49c4a2f913
SHA1 a83ec3b1a6b48e34f32ebed74d173d5ddf581417
SHA512 b3a7de0b88c90d0e881271d6815344bdcf4a73ce8119b113d691ccb1d2f5a7938aea80dd3a333704530b706de41b987c241140e6eea238636af952158bc57a7b
SSDEEP 192:LONv6AmwprQmiUyFH6siX5FC3jzor9mylJi8MU6:LONv6ipdu6siX5FC/8TiJU6
TLSH
T1DC02EB35BC786C7F8AF2AE45B18736135F99116BEB952F84CAE8172D01D725C1306932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6788dcb6287a92ad237655486433243db1373fdafe301bc369e0fe2e306ee67c
MD5 b8b6082e957586afc9fc015e653bca5a
SHA1 e08ff76d3d948effaf155cdb0e43418dfe00b763
SHA512 172e68c5dce455429486eb84db4be76456264497bde3e149d70d3e739633bd07c6e216ce5d8d355dd39cea538e6b9aa77ef598b989d1c6852e0a888419d582ad
SSDEEP 192:LONu6Amwp5QmiUyVHYsiX5FC3jzor9myXXXFi+2XlR1/EU6:LONu6ipXYYsiX5FC/8TXX1i+2bSU6
TLSH
T1AF122C36B878AC3F4DE2A655B08735139FA94117EB8D6F94D9EC172C02DB65C530A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 8d06ff84907ec3bd7487a93961e5fc05518e1956f4118bd5ab96688f8780d551
MD5 ea33fd4e52473611d11c30d49ebf8649
SHA1 cc92ce260f1263d3c678016729ae49da2046cb88
SHA512 693e122bd5788d0f71fd7d32abd0fb6285c69e69bdfc3f1745497ef46764b368bbbdff7a0fc6297a0a301ed95bf23881167956ec3ba7721d7ea22b8d1d0e611a
SSDEEP 384:rsNsUFDi1pulZo9iX5FC/8TXX1i+2eS7O6R2Feoyh7Ul:rdSsauMcleS7TRpw
TLSH
T13F625C367878AC3B49B2A665B00B3A139FF54167DBC91F94D5EC1B2D02CB79C530AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 279b638c8ca2709d66168065eb363be483fc668573abb0e63d633ea22a383e49
MD5 9bb796ec84729ef89886bf5c85a4a485
SHA1 5e807bf3157f02e1627ef810a838e749ba7b86b2
SHA512 6107fd21892d3b13293a375f08b785433639f5993b11c4e4a5a3a92b886ed2a20a6ae4d3651434c0505b84c85ecb11efdec73f3abb7890bb8d5f585c8e048b03
SSDEEP 384:jZcIgsNsU6Di1pu4To9iX5FC/8TXX1i+2ES7O6R2Feoyh7UQoZ:7gE3sauMclES7TRpJO
TLSH
T185827C3278789C3B59F2E265B44B3A139FF94067D7CD1F94D5EC5B2E05CAA98130AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f77bca57-3fda-49ca-b1b1-86aee2d0eab7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f77bca57-3fda-49ca-b1b1-86aee2d0eab7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 413fae67bf51d9de743458ee78d6977b52abf3a4332fadb4ec3d241cace92f4b
MD5 28941d687b1a1fe4c11bdfbde2f6bb5e
SHA1 af88daf5bf3c9de5b5cb8de9c500961e31c1704a
SHA512 16705e8fce18c0cae714358e310a7e23735424d53f2c491c165e7f95e9919d3808716f3f4480cc20f4743ca7424d0a785d91a00eea5095287532af648f5e5e6e
TLSH
T1FC41275DBAEA1148B3B36E5A9BF3A92D487F79372E06D55D10010E4E0A27B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download