hxxp://openlinkdesk[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://openlinkdesk.com
Sample261030-kten8aaz21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2176	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{403FC039-E054-425B-B043-27D0052609A0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3344	msedge.exe
3344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 5408 wrote to memory of 3920	5408	msedge.exe	86
PID 5408 wrote to memory of 2176	5408	msedge.exe	87
PID 5408 wrote to memory of 620	5408	msedge.exe	88
PID 5408 wrote to memory of 620	5408	msedge.exe	88
PID 5408 wrote to memory of 620	5408	msedge.exe	88
PID 5408 wrote to memory of 2440	5408	msedge.exe	89
PID 5408 wrote to memory of 2440	5408	msedge.exe	89
PID 5408 wrote to memory of 3992	5408	msedge.exe	90
PID 5408 wrote to memory of 3992	5408	msedge.exe	90
PID 5408 wrote to memory of 3992	5408	msedge.exe	90
PID 5408 wrote to memory of 6000	5408	msedge.exe	91
PID 5408 wrote to memory of 6000	5408	msedge.exe	91
PID 5408 wrote to memory of 6000	5408	msedge.exe	91
PID 5408 wrote to memory of 2604	5408	msedge.exe	94
PID 5408 wrote to memory of 2604	5408	msedge.exe	94
PID 5408 wrote to memory of 2604	5408	msedge.exe	94
PID 5408 wrote to memory of 2896	5408	msedge.exe	96
PID 5408 wrote to memory of 2896	5408	msedge.exe	96
PID 5408 wrote to memory of 2896	5408	msedge.exe	96
PID 5408 wrote to memory of 5740	5408	msedge.exe	97
PID 5408 wrote to memory of 5740	5408	msedge.exe	97
PID 5408 wrote to memory of 4076	5408	msedge.exe	98
PID 5408 wrote to memory of 4076	5408	msedge.exe	98
PID 5408 wrote to memory of 4956	5408	msedge.exe	100
PID 5408 wrote to memory of 3400	5408	msedge.exe	108
PID 5408 wrote to memory of 3400	5408	msedge.exe	108
PID 5408 wrote to memory of 3400	5408	msedge.exe	108
PID 5408 wrote to memory of 4048	5408	msedge.exe	115
PID 5408 wrote to memory of 5324	5408	msedge.exe	116
PID 5408 wrote to memory of 5608	5408	msedge.exe	117
PID 5408 wrote to memory of 1028	5408	msedge.exe	119
PID 5408 wrote to memory of 1028	5408	msedge.exe	119
PID 5408 wrote to memory of 5384	5408	msedge.exe	120
PID 5408 wrote to memory of 5384	5408	msedge.exe	120
PID 5408 wrote to memory of 5384	5408	msedge.exe	120
PID 5408 wrote to memory of 3908	5408	msedge.exe	121
PID 5408 wrote to memory of 3908	5408	msedge.exe	121
PID 5408 wrote to memory of 4700	5408	msedge.exe	122
PID 5408 wrote to memory of 4700	5408	msedge.exe	122
PID 5408 wrote to memory of 6128	5408	msedge.exe	123
PID 5408 wrote to memory of 6128	5408	msedge.exe	123
PID 5408 wrote to memory of 6128	5408	msedge.exe	123
PID 5408 wrote to memory of 3344	5408	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://openlinkdesk.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffec040c188,0x7ffec040c194,0x7ffec040c1a0
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,12774808312465618122,5385792657705933765,524288 --field-trial-handle=2432,i,14910568728139006337,4673208024318650300,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,13477913447060766446,3010455996994524287,262144 --field-trial-handle=2432,i,14910568728139006337,4673208024318650300,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:2
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,10073085417677987881,11327260346602704477,524288 --field-trial-handle=2432,i,14910568728139006337,4673208024318650300,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,5896834135667629401,2213456529457807157,2097152 --field-trial-handle=2432,i,14910568728139006337,4673208024318650300,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,8160430022179758513,2788287287575925400,2097152 --field-trial-handle=2432,i,14910568728139006337,4673208024318650300,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4968,i,5609247757277790490,16189649090661270054,2097152 --field-trial-handle=2432,i,14910568728139006337,4673208024318650300,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3676,i,18342337090972523424,11784240313099945184,2097152 --field-trial-handle=2432,i,14910568728139006337,4673208024318650300,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,16829538845701827035,1163258322990468872,524288 --field-trial-handle=2432,i,14910568728139006337,4673208024318650300,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:8
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,15935515505127603759,11114085400839605564,524288 --field-trial-handle=2432,i,14910568728139006337,4673208024318650300,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,11699623673815562156,8518282076559445197,524288 --field-trial-handle=2432,i,14910568728139006337,4673208024318650300,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,11699623673815562156,8518282076559445197,524288 --field-trial-handle=2432,i,14910568728139006337,4673208024318650300,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6132,i,4312426442622374316,7955359278782488207,2097152 --field-trial-handle=2432,i,14910568728139006337,4673208024318650300,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,11013482818358826045,4509924581462799041,524288 --field-trial-handle=2432,i,14910568728139006337,4673208024318650300,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,5100796914573980250,6283571060035522758,524288 --field-trial-handle=2432,i,14910568728139006337,4673208024318650300,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,18392532321988347605,9259104208422626856,524288 --field-trial-handle=2432,i,14910568728139006337,4673208024318650300,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2992,i,16186490357225572399,17970288891956412032,524288 --field-trial-handle=2432,i,14910568728139006337,4673208024318650300,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5432,i,8313627760109461716,11279247183449624263,2097152 --field-trial-handle=2432,i,14910568728139006337,4673208024318650300,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,10046495038985274854,12271513975616224804,524288 --field-trial-handle=2432,i,14910568728139006337,4673208024318650300,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,3909784191100042483,9859266059212582132,524288 --field-trial-handle=2432,i,14910568728139006337,4673208024318650300,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=760,i,8757964144796353947,4143815622548721306,2097152 --field-trial-handle=2432,i,14910568728139006337,4673208024318650300,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5912,i,3963108450377191264,5360642581001718481,262144 --field-trial-handle=2432,i,14910568728139006337,4673208024318650300,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3344

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3f456c92-1e49-488a-ac7d-b02e2d7c7007.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3f456c92-1e49-488a-ac7d-b02e2d7c7007.tmp
Size 26KB
SHA256 6601e1988f2e3c49f7da7c81031261365b602b9d8b5b7545c14c98d010bcf465
MD5 0453a7cf0ac4ae7e71789d968b7c2765
SHA1 85517be50a4061de6a4272ff9d8c4dfc165106d7
SHA512 98b980485d2a3c03c0366dd854462e7857dacff9d774c7400162ca6974ef982716365a4ec494098a72b92e453fee3ce4e291c311bc85e8e3babf3d75307c4be2
SSDEEP 384:nyiFiZcI63sNd8TUNTUlIm2aKMe7UwzWfLBCh7SUZ4mY5ukiFsa+VY5agL/7Iz6q:5FQ63gwgccTEBChf+mY5ZiFhggq
TLSH
T1E2C24A32EC98C9ABECEB4FD5AB8A3603DEF44263958C9AD4D5D91D1C00D759D430BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

85ac8f04-56a3-4e3f-8466-2d66b2724e9f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\85ac8f04-56a3-4e3f-8466-2d66b2724e9f.tmp
Size 26KB
SHA256 1663647058b334c30014c71f6adf35303bdc2403b573704dded7c75a2f5cfe86
MD5 b068ccfcef2b4510c16eb7672e7f97fb
SHA1 8322ad7b67717af9d49193d455dbe526150ccc05
SHA512 c633276e66309b045e839c4c8eae4e164565d52524bc18861919c995eed0162db8a15955684f0426db41fb084d37ed6daf029d3dc9a00dbfecf107a56a38f701
SSDEEP 384:n9iFiZcIe3sNZ8TUNTUlI42taKMZJnwzWfLBCh7SUZ4mY5u1iF2ITMtUngL/7Izv:0FQe3Qwgc1CEBChf+mY5iiF5qUM6
TLSH
T196C25B32DC98CAA7ECEA8ED4B74A3603DEE44163D69C9AD4E5D91D1C00D75ED034BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

979d5361-cb10-4733-a40a-0787dcf3a4ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\979d5361-cb10-4733-a40a-0787dcf3a4ea.tmp
Size 27KB
SHA256 440876831a9c1ffad4bde49818079e4b58d52ede52a69adbd8df90dfeff0ff57
MD5 a33e94fbd04a3b56c6fe8ef8e770eca8
SHA1 b54c1d395b52a66a51993bef0a19779dda72e235
SHA512 ad3811505c7b847df25533815d37455952e4421e02653417e757aaf970dfdc331cd1b677c9c916cae8499f438cac0049d0fe35ce1f8ca8ba59d5cf6da6132f33
SSDEEP 384:nfiFzQkUSvLU3sNZ8TUNTUlI4IaKMJJnwzWfLBCh7SUZ4mY5uxmF2ITMtUngL/7v:qFdo3QwgkZCEBChf+mY5UmF5qUOLp
TLSH
T16CC24932DC98DEA7EDEA4ED4A74A3643DEE04263C98C8AD4D9D92D5C01C71DD434BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

172e5838-4938-4046-9dad-430d3d4ce72d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\172e5838-4938-4046-9dad-430d3d4ce72d.tmp
Size 414B
SHA256 7714393a2c50233bd3bf32dbd99c21e1d6f81cacbe546b6a806e9ee229627651
MD5 9a0ad8c83501d16f2057564b36dfe1cf
SHA1 5418055cccc533de2e8c1ef60c3ebc1459970c55
SHA512 58c7e2ff857c2c27d82adfaef9582d92118c659a71f84c285481c81777526120bf01d50b5c13c97cfa30b9ed1961a2cf0e06c24cadb11ed83e5612666a6a62c0
TLSH
T19EE02B6AC915EC3B09FD0B7850540649EB0423272B40994F3B3D95088FF0537458587C
MD5 SHA1 SHA512 TLSH

Submit Download

3b4d6d21-7f6b-4086-a50b-a35863f5ef50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3b4d6d21-7f6b-4086-a50b-a35863f5ef50.tmp
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d2595cb-f00f-43e0-a99a-34b5f86e9a15.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3d2595cb-f00f-43e0-a99a-34b5f86e9a15.tmp
Size 11KB
SHA256 f02a72570e229b6ab1dd62ee46dfeec9c92fa59a3fa162ee0dbcb59de4797246
MD5 fee14ec3aaa841d96c6c671a166dd370
SHA1 65eb9e243fd62d77f56ad734657285266096d101
SHA512 11294e2f3ac45944fa1745edbfe83c0e194f3963dde451a742961fb26b88688789601d57f478e386c9891ccc88dd8684624ef84a5fc81d3583e4535177407a4b
SSDEEP 192:sxZBRHkH/fUsRaQZLZ85zodpy+Htg46+WNGYorRiSj+VIgjtMJ:sxZByH/fUsEOqyFHMGOSjajtw
TLSH
T14242D7156D28693B8CCBD219FB557F53E7F9103291811F44AAFC8A1C15E7ACD620741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

742b4ef6-0b9f-4026-a32d-124c3e38ddf1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\742b4ef6-0b9f-4026-a32d-124c3e38ddf1.tmp
Size 12KB
SHA256 5430b9070231e971f3059f5a9ee6f67d2a1b9b48b9a10e84f6db51dc4d448274
MD5 ff72f977bf45d5b1a130b5f9f536c1f7
SHA1 bf9d1b48507bcd5332cb8c30922be3e8334b4d94
SHA512 1ce21e8a0bb53ef3315d8e0fcce9819b87616b109c1543dc6135ca838662c85738c7302f60ff369cd0d4f02c14d36b6b8aea1463f12d53aa80915a418803436d
SSDEEP 192:sxZBRHkH/fUsjaQZLZ85zodpy+Htg46+WNGYorRiSj+VIg5OtMJ:sxZByH/fUsmOqyFHMGOSjaktw
TLSH
T1F642D6156D28693B8CCBD219FB55BF53E3F9103291811F48AAFC8A2C15E7ACD620741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c594ac7-e46d-43e2-aa27-51a8449fc610.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7c594ac7-e46d-43e2-aa27-51a8449fc610.tmp
Size 12KB
SHA256 ebbe8e0078825314a14c9aa30a6e2f31101aa45e49c665dfb3cd79b44f2ed498
MD5 98df584e76b831ad618a91fb8787868c
SHA1 88751b716541e34dc971f3b2c01019670700f6a3
SHA512 edef2ac1f9621ed3affbc6205e2d0fd496c83ba67152f96e3e3b391b3206814b7fddce0faf331e908784e37f8ec44193096ae70cfdcfceb0d31a5a0a70470df2
SSDEEP 192:sxZBRHkH/fUs7QZLZ85zodpy+Htgw6+WNGYojRiSj+VIg5OtMJ:sxZByH/fUs7OqyFH0GCSjaktw
TLSH
T16E42C6156D28A97B8CCBD219FB55BF53E3F9103291810E48AAFCCA1C05E7ADD620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7d1d4813-64a9-418e-b952-38d4f32c6271.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7d1d4813-64a9-418e-b952-38d4f32c6271.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 d29b559e5b2e9e82ff4695bd21b38cf9881a867866e7a264a3a13fd5b1bcc7dd
MD5 46465eee0974f26a94066e6a9f653e0e
SHA1 cba41867999bfb36c6eb3e967b6b15487628e084
SHA512 8f3fcc56166167b7407de493a02cfcce37e3c0f8461896716d98f3287e80b9eecf4488260cceb376506be45bb818cf233685f5b52572e766c7042c348203b589
TLSH
T1F1E026A644CAC32FE60864B701B8630CD3C1363BD2C0790E270DE5CEF409050E283AD4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 0077dba9281012f5cf222ebcccb994ade1cdbc996adde978f24ebb21b725a21a
MD5 6257756fba04950966647c9668739b0f
SHA1 f1c1f2b5b6c1e80ec4ca2fa4f080e858ad9392d2
SHA512 9b9a993f115d045c3faf9dd28d879dae747a783da1b94b98672846fefebae75af94db5599b24767fcd74b75d9377e205dc82fab968e9d9933638ae0977911743
TLSH
T1A7E026AB4CCAC26FE208654703B8630CDBE0263BE6C0BD0E2B0CD5DBB409040E7836D4
MD5 SHA1 SHA512 TLSH

Submit Download

74845fb3-768b-4d6d-a624-b2f3e891ae80.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\74845fb3-768b-4d6d-a624-b2f3e891ae80.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

114483ef-0416-4444-bea7-319e94b038cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\114483ef-0416-4444-bea7-319e94b038cb.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

24cfab50-d68a-419a-b77d-f3de8c682143.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\24cfab50-d68a-419a-b77d-f3de8c682143.tmp
Size 1KB
SHA256 0dbf15176d813d775cd0b3e1b61c52fb4a7034bb92f84a8576418b8b65174eff
MD5 910a4a9e5d7976043318c31e7904c97b
SHA1 11acf4f1b426108c02771db8645fb14834ba0de3
SHA512 ee115db5c616d2c9adbbd300a44711d06081c421167a2390f4b2ff82f2194088226cd2523a8ac195b5cb6891c349161abc045461aaa0daf91c935331f3f85fe6
TLSH
T15331AFF387B4856E8A0196F0AA18AE2BDE2D0515432C7DAAC4E4AF27C3F3471D14165F
MD5 SHA1 SHA512 TLSH

Submit Download

d4736818-dce3-4d2d-9289-9296664ab102.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d4736818-dce3-4d2d-9289-9296664ab102.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 856e107f83fa4ad7f909286cf5b37433d1b809bacefcfea38078cdfac6cabcd0
MD5 c35a6842069590cd39283daed0d0c302
SHA1 d510e61acc0f2e44b62de17a7933d103f1fc1c36
SHA512 227238e31716c8e5bebe0cbeedc3f0d99c1bea091c204878ed84aa0458456d8b0f9981b4a9adea93b4dcdc4a9bd3d1093341533459785a3208b5ce71297e5b01
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdg9:ST/2dXOJhJlpfnpp3tNXVrN3aJhS
TLSH
T1A9B2125571BB021039FE291C92B59B2E168231733119E66B7FBD40B68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

adb1b5e6-5b1d-438c-97d2-7b4b21cd9ad5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\adb1b5e6-5b1d-438c-97d2-7b4b21cd9ad5.tmp
Size 25KB
SHA256 05b330389a23e5e4f70961fffa2a91374d69550d58c090e8afa18ac4993f5c25
MD5 0bb833fbafc3dc1e832221dfae7a2d4b
SHA1 6a33c9769da17477381b67be5e372214dd67a4e5
SHA512 ccfa29ab71fddcf1005635d4643dfa6306e9b046ba3ae0f347b5eb952180241fee99c5edc9fb9efb226b3dd067cdf0b928d1f65dc3cfafe692321e6fb2567eb7
SSDEEP 384:nUiFiZcI63sNU8TUNTUlIm2aKMiS4wzWfLBCh7SUZ4mYpF6sa+VY5agL/7Iz6o5:vFQ63Bwgc3HEBChf+mYpF6hggq
TLSH
T179C24B36EC58C9ABECEB4FD5AB8A7603DEF401A3959C9AD4DAD91D1C008759D0307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e824d372-e4e4-4766-941f-1fcbcd63e2aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e824d372-e4e4-4766-941f-1fcbcd63e2aa.tmp
Size 26KB
SHA256 67441d03fd4eaaa4c5496a3fa3c33292edcefa3d68e87904b88ed1f9b0fe8e73
MD5 0b3f8d18ea27a3902b528e74e2d26920
SHA1 614ae9a66fb502e28cad4a4623583e1a00faaebd
SHA512 b7530043fa05abe07a15ce29f5280f54097eca9401e07805e8aa6d6974e1449651252661c1ed542f58345350a459e61f4b292df4e80c4ef72554296b8b1faea2
SSDEEP 384:n9iFzQkUSvN3sNZ8TUNTUlI4IaKMJJnwzWfLBCh7SUZ4mY5u1iF2ITMtUngL/7Io:0FdN3QwgkZCEBChf+mY5iiF5qUOLp
TLSH
T170C24932DC98DEA7EDEA4ED4A74A3643DEE04263CA8C8AD4DAD92D5C01C71DD434BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e90247d1-3752-4f1f-ae6d-c14c8dac07a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e90247d1-3752-4f1f-ae6d-c14c8dac07a1.tmp
Size 26KB
SHA256 4e627d2f867aeb5192840fff5697fc4bace9eb51fe0625ebfdd02e49e9aad398
MD5 ad6fb0ed8d424ac0f7ab272c9e29f46a
SHA1 f6a6267591960eeb925c3c9c490563aecddf698c
SHA512 4b10f80dbea6292c361bc159e20209c18af89f40f55c4308c3a0fb7c6375658cdfa1ec11e1f5224c45eeba6dc063349e6b2c3c9c477fb7e3c8d632e76c590f9d
SSDEEP 384:n2iFzQkUSvN3sNZ8TUNTUlI4IaKMJJnwzWfLBCh7SUZ4mY5u1iF2ITMtUngL/7Io:dFdN3QwgkZCEBChf+mY5iiF5qUOLp
TLSH
T1CCC24932DC98DEA7EDEA4ED4A74A3643DEE04263CA8C8AD4DAD92D5C01C71DD434BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 05a3c1195876a34d780b32d6d1e288f6d62dfc0b3515f51c9ce00e68f747c856
MD5 069dcd59c42b8b4dffed66c1c1bf4ac6
SHA1 cef4d5c41aca54a47cb58d35c7418383d005a07a
SHA512 534be15a092248c1b85be1e5378c836b4948151829080486cfa56e4fdf71c6c1c90dde00628f7e9d849dedc1c0b843eed7e1a156cb5657b0a87e66e1f3b01478
TLSH
T1AA412458A6FD1148B7B32E5AABF2686E487EB8372E47D05D10120E4E0A62B04C861B37
MD5 SHA1 SHA512 TLSH

Submit Download