hxxps://13wham[.]com/news/nation-world/florida-school-district-argues-teacher-should-still-be-fired-charlie-kirk-comments-martin-county-school-district-treasure-coast-news-matthew-theobald-social-media-facebook-comments-suspended-fired-free-speech-too-far-turning-point-usa-backlash

Analysis

user interaction
yes
max time kernel
56s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://13wham.com/news/nation-world/florida-school-district-argues-teacher-should-still-be-fired-charlie-kirk-comments-martin-county-school-district-treasure-coast-news-matthew-theobald-social-media-facebook-comments-suspended-fired-free-speech-too-far-turning-point-usa-backlash
Sample260707-pxjjssh18x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4876	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279017622207742"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{F77679F4-27C9-406A-A14E-07038653B690}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 3044	1536	msedge.exe	85
PID 1536 wrote to memory of 4876	1536	msedge.exe	86
PID 1536 wrote to memory of 2584	1536	msedge.exe	87
PID 1536 wrote to memory of 2584	1536	msedge.exe	87
PID 1536 wrote to memory of 2584	1536	msedge.exe	87
PID 1536 wrote to memory of 4084	1536	msedge.exe	88
PID 1536 wrote to memory of 4084	1536	msedge.exe	88
PID 1536 wrote to memory of 4552	1536	msedge.exe	90
PID 1536 wrote to memory of 4552	1536	msedge.exe	90
PID 1536 wrote to memory of 4552	1536	msedge.exe	90
PID 1536 wrote to memory of 2792	1536	msedge.exe	91
PID 1536 wrote to memory of 2792	1536	msedge.exe	91
PID 1536 wrote to memory of 2792	1536	msedge.exe	91
PID 1536 wrote to memory of 3804	1536	msedge.exe	92
PID 1536 wrote to memory of 3804	1536	msedge.exe	92
PID 1536 wrote to memory of 3804	1536	msedge.exe	92
PID 1536 wrote to memory of 3912	1536	msedge.exe	93
PID 1536 wrote to memory of 3912	1536	msedge.exe	93
PID 1536 wrote to memory of 3912	1536	msedge.exe	93
PID 1536 wrote to memory of 4480	1536	msedge.exe	95
PID 1536 wrote to memory of 4480	1536	msedge.exe	95
PID 1536 wrote to memory of 4480	1536	msedge.exe	95
PID 1536 wrote to memory of 2592	1536	msedge.exe	96
PID 1536 wrote to memory of 2592	1536	msedge.exe	96
PID 1536 wrote to memory of 2592	1536	msedge.exe	96
PID 1536 wrote to memory of 3988	1536	msedge.exe	99
PID 1536 wrote to memory of 3988	1536	msedge.exe	99
PID 1536 wrote to memory of 5048	1536	msedge.exe	98
PID 1536 wrote to memory of 5048	1536	msedge.exe	98
PID 1536 wrote to memory of 3996	1536	msedge.exe	100
PID 1536 wrote to memory of 3996	1536	msedge.exe	100
PID 1536 wrote to memory of 3996	1536	msedge.exe	100
PID 1536 wrote to memory of 2264	1536	msedge.exe	101
PID 1536 wrote to memory of 2264	1536	msedge.exe	101
PID 1536 wrote to memory of 2264	1536	msedge.exe	101
PID 1536 wrote to memory of 2528	1536	msedge.exe	102
PID 1536 wrote to memory of 2528	1536	msedge.exe	102
PID 1536 wrote to memory of 3504	1536	msedge.exe	107
PID 1536 wrote to memory of 1996	1536	msedge.exe	108
PID 1536 wrote to memory of 1996	1536	msedge.exe	108
PID 1536 wrote to memory of 1996	1536	msedge.exe	108
PID 1536 wrote to memory of 4812	1536	msedge.exe	112
PID 1536 wrote to memory of 4812	1536	msedge.exe	112
PID 1536 wrote to memory of 4812	1536	msedge.exe	112
PID 1536 wrote to memory of 4244	1536	msedge.exe	113
PID 1536 wrote to memory of 4244	1536	msedge.exe	113
PID 1536 wrote to memory of 4244	1536	msedge.exe	113
PID 1536 wrote to memory of 912	1536	msedge.exe	114
PID 1536 wrote to memory of 912	1536	msedge.exe	114
PID 1536 wrote to memory of 912	1536	msedge.exe	114
PID 1536 wrote to memory of 5276	1536	msedge.exe	117
PID 1536 wrote to memory of 5276	1536	msedge.exe	117
PID 1536 wrote to memory of 5276	1536	msedge.exe	117
PID 1536 wrote to memory of 5416	1536	msedge.exe	118
PID 1536 wrote to memory of 5416	1536	msedge.exe	118
PID 1536 wrote to memory of 5416	1536	msedge.exe	118
PID 1536 wrote to memory of 5424	1536	msedge.exe	119
PID 1536 wrote to memory of 5424	1536	msedge.exe	119
PID 1536 wrote to memory of 5424	1536	msedge.exe	119
PID 1536 wrote to memory of 5432	1536	msedge.exe	120
PID 1536 wrote to memory of 5432	1536	msedge.exe	120
PID 1536 wrote to memory of 5432	1536	msedge.exe	120
PID 1536 wrote to memory of 5440	1536	msedge.exe	121
PID 1536 wrote to memory of 5440	1536	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://13wham.com/news/nation-world/florida-school-district-argues-teacher-should-still-be-fired-charlie-kirk-comments-martin-county-school-district-treasure-coast-news-matthew-theobald-social-media-facebook-comments-suspended-fired-free-speech-too-far-turning-point-usa-backlash
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc32edc188,0x7ffc32edc194,0x7ffc32edc1a0
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,10360659800623710881,3612875954611107116,524288 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,17661722669598698708,16952558578271306540,262144 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,14848672381839695157,12399783478201256020,524288 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:8
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,3556161833655304053,11847466061674332880,2097152 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,26953372455893240,6831048478477904386,2097152 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,14735376024873986123,15058698572059793492,2097152 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,13546077143701919579,1442497854958586853,2097152 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3460,i,13357941688361890332,11975007559733970791,2097152 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5240,i,8072668744313401944,15648287778032992521,2097152 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:2
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,2143516870593131453,18217975943377232732,524288 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,16775750979690207446,1109312159909670104,524288 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5788,i,9501114358093854689,12701660473213811829,2097152 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5928,i,12972336768415282901,12890440119346493041,2097152 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:2
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,15451004367007431546,17171149274151100555,524288 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,12870684920435911084,7923533331722975755,524288 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,12870684920435911084,7923533331722975755,524288 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7044,i,16774931206324228018,2712623628732669458,2097152 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6920,i,16007531346082647249,9635234286664817948,2097152 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6804,i,12214647249940765783,4050433719229662289,2097152 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6692,i,3552019382188671647,15066194446036258850,2097152 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7876,i,16156674794606998612,4676995865364823338,2097152 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=7884 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7332,i,4354880499577089517,4650722899874389044,2097152 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7776,i,5867996355918579805,10252903412883990629,2097152 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=8112 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7596,i,17193402434687339709,17237024425723792702,2097152 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=8048 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=8292,i,4958379468530241609,17052016020735400472,2097152 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=8300 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7332,i,13229834134027497154,7151598118069689833,2097152 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=8352 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8560,i,15537216068799947238,11938279033342034496,2097152 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=8572 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8596,i,12985671162224704152,14082176787891995808,2097152 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=8620 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8848,i,11082966773785285017,694666918103321446,2097152 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=8860 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=9044,i,7735647676218104883,10587196719549543997,2097152 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=9056 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=9172,i,12039805895015945281,33690477417864477,2097152 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=9168 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=9328,i,12483154646864562571,10087693459272244982,2097152 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=9324 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8848,i,3522292454515640582,8474272918453104252,2097152 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=9552 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9992,i,3483888617757743893,8657515068120337295,524288 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=10116 /prefetch:8
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9964,i,2783735584875739181,2063593774470815788,524288 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=10004 /prefetch:8
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9996,i,2291217375642482762,7813570491826632712,524288 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=10012 /prefetch:8
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=5740,i,1452734312345307932,5825676245661094451,2097152 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=5572,i,16131350950002055784,4536169261656190132,2097152 --field-trial-handle=2188,i,5866064635866333050,10411458908706165900,262144 --variations-seed-version --mojo-platform-channel-handle=9816 /prefetch:1
  2⤵
  PID:5332

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 16KB
SHA256 92d5e719e4cc4fe1b0bbff1cfc41e5f18274b3a451b2b9fe9f1ffc827337597c
MD5 43c7db1552c43f69810b3c2797b24fb7
SHA1 e7fd063fea0d0e2b5f818b28e83ca2496dc21ecb
SHA512 4af18e6d8b4911d033684160227d10f64ca65ce18ac4f9efb258b4f39fe17615181e8f216a7efba0c42db8ffe9cc56a89f04b3f6bdda288fced99ef23a42704c
SSDEEP 384:YWDrB4htZyWn7W3JXER0G2McS35C3pD1HRC1S2m1+KeuS3:XDrBIsg0GpREppxCtm1+KeF3
TLSH
T10072D1202856AD7EA50D13CF5CF348234B51DF5AA6B54B730EEAA7D501A65390F9036C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 22KB
SHA256 7476553a0c442bad7a88d2fddaa49acb67819516d4db4db372cff48112cd74e6
MD5 e5a1d90c4e66119b065592499d865c6d
SHA1 d26c04c242747c06b0dab83589e88c090a5e2e40
SHA512 09ababbf05ee82dde234c956e5d733eb0d1ce19e96f4464ba85eac1cd39fed227c2dee0e449f8c362084557fe06195bee8c08595bd957792b56fb1a225910e00
SSDEEP 384:IA2t8ns7JBRNvrczQFnCsbGSn3K6u6PqJTJ8CSpJ6l5GMoEYMKv6kUdgzhIp5WyP:I/7JC0FnCsCwuGqJTmCSI5K4amuhMVP
TLSH
T1C8B2E012B6AAB1ABBFB2435401AD1667F8389D090BB5CD652B404CD2F96332F85FF650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000112

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000112
Size 203KB
SHA256 f0ae8179a01cb9628b01373ebc959025ada25c9beabe4fc96adc8897dbe1e979
MD5 1cbde2c32603efaff54245cd12b46e5a
SHA1 fdc5fe49419e01e861b51cbe527a8977ecc4182e
SHA512 d8fc0d8805c7d450316d1761dacd044a449315d66b4d9625689720021bc58e93736416c5b7cac5144b971a671f148404a219e390b1800ec1742db50c5db9db82
SSDEEP 3072:VVwcpjJ4MHGSjJYUg+Rq0mk0reC2kK9EKvfDa5YCEDkEpjcQQC+6lkqvBjn8f:VVwkzjq1zrks2SKv2yEEpjN+Dqxn8f
TLSH
T1A11423752CE0ADC185043E91FC94506F73A157A8C8EE1764ED2582CD5BBBAF8F3A0716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

fad6bc80-f644-45d9-b961-2d4290108714.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fad6bc80-f644-45d9-b961-2d4290108714.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 967bfbaeebb3187495d1a61fd6ad9ca1f5a7669296543516887cb0f404a9dc78
MD5 972a04e93f1841869cee6e5d0eef25e0
SHA1 127fa4054ca3435fbdbda4c435c7b744c76837fb
SHA512 e4213539d3d7c9c223da31f73dfe9f42c6d6123ae14aff2ee9efefd7370c0964222e8ed6e98f698f77387738517dff64450ae70c033987679a083c04b17e89ff
SSDEEP 192:sxZnRPyM/jK1Ml8MkS/fqsmf4AtVYEdphPHW6+WNGvKL1/Yv2Ssj3cIgrJ:sxZnjMS/fqsmfnHlHb1/HQ9
TLSH
T19242D912AB345977CCDBD209F955BF93D6F51562A3900E48AAFC8A0C01E7AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7b46e91dd356bd6ddb2d27e9e4a56ce38de0b8f9fe6982a3400d55f456817313
MD5 90c5c4a78b8ac6f389166f5515656407
SHA1 a36f1756f59286ebda5afd680433058a93d949ed
SHA512 1ce0e6efedf8c04567782c9f9c614bde0dc4d27ee3bd1ecd23baa22d6dc7928b2824a83c789a6e778c465d642ca81f939f442dd9c48a8a52a2c0ef00de4b1a98
SSDEEP 192:sxZnRPyM/jK1Ml8MkS/fqs+f4AtVYIdphPHW6+WNGoHdYvtrj3cIg5uJ:sxZnNMS/fqs+fnBlHb1d2Qk
TLSH
T1A752C712AB345977CCDAD209FA45BF93D6F9146292900E44AAFCCA0C05E7BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d2878117e5720f4ecd9aa6d0f29b1ff850ba64c618db0aef5b486842727dc986
MD5 50d835d70a44b2dda3801079269bb456
SHA1 63939cbb008df02d6171f9bf17bde06d5055a0a0
SHA512 61e02a5b149be17378f78c2082f1d5914e4a8d278ab50bee65b185bffecf61475c1ee446015f6019fbc1bb1e46c9c749c8db6b8f1eb10516faded92aa5611359
SSDEEP 768:fbseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppkro5m:fbseJ3xWvhfynu1jaVcL88pvY
TLSH
T1CFD21B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA884C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 b1de4dde62b6dc5f067a7f5c348e1393bda6f3825b1f992703aa39525723a6ef
MD5 4922af78dd144a046bd55a7df55a0842
SHA1 5e420d81e771923d1b5af6cea51961a39a9706ae
SHA512 b5a14cc180e315fc992df375cda3aaf8c282e9fa5221e884a01513d5ceaa528762b318c0e5f77f013bc13eac080b9e96cbce6935d150c0d9ba56f33ec0531336
TLSH
T107A002A065519002E244077011E199406F35AE10030ED202B1E04CDECD66146611917C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\fd7f5942-04b6-446f-8338-52e3091aac17\index-dir\the-real-index
Size 72B
SHA256 d535029ae1087fc03b98a4be4c87bb715fbe7ae9411bf6e3b012294bebb89887
MD5 f80e40267ac9cf4e107c8d5a5e7accbe
SHA1 de2c513bdc4748f457bfa8f00b79629ea5cc27e9
SHA512 a1b73892b2d1eed9368459835c82329c9a8f16cdd2be95e1170e2b25bb0fb163074c33d28508e99df7bd2d62d863067cddccbb2ef7b3ed73b7e7a707d4d506c9
TLSH
T1B6A00228056C4605D4044E7124671175B6794D60EE0A035681E071A5C9D1299518753D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5919c8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\fd7f5942-04b6-446f-8338-52e3091aac17\index-dir\the-real-index~RFe5919c8.TMP
Size 48B
SHA256 ccdee62c71c0a0a16f5b7224fb614a8d48659d0f1a20765d8524f61523510705
MD5 9bf74ce680c98f61d87ee5e7dfc17d8f
SHA1 9c1a345697881ba2677e338a6d0e84e4cea20e84
SHA512 6209eaab99e2b244954adf2b817e42256a656ae9dfbffb6b9a9a1e4050eb31af9514f44fa30e29c23f8b8ab7add49ef8bbf46609dcabb1820972258caa356f6b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 150B
SHA256 359b1787d184e3b1f1e413e0a25a2dd27239c420233e3bfb32bfb47214e43574
MD5 990b8fba137922045221dbddab8e2e18
SHA1 c080ba314c2a6a76f0a887ef16f69c774d0fdddf
SHA512 7e710ef6895f54c3c6bfab7728e1ee2813c0dffa30220c9845f7b26943d5106e25b9a744f415e4b56cb112c0606dd8ee0eb6014638d98d169b876b2acd3a8afb
TLSH
T18FC04CEB9465C79A4F34AAE9303C761DD50F928A8CE0CCE4954851852778D235D06A6C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 234B
SHA256 32f93877de4a33a026a76cd3b322f59630a76f6eff770ade3979f8940fc9143b
MD5 78d12b74c954c40c9cd43e20203f91ac
SHA1 d0cc658b06cdcc52ddfdf2c1f45cbbfa2a846aa9
SHA512 bc1eda78c682febe6f917fdb7e58f46ed3cd9ea6d430dcdca60178b4bc1e890cb6d39371dbeb4682c84a94b151e9dadaa46cdddc763d83ac4c3b81918994d42c
TLSH
T15BD0A7DB90B1C66B2F30AA99203C311DC01A9F5B8CD4C8948644B18266B8A13EA0596C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 151B
SHA256 03fb5535176170714bffbcfbd84ffb7511cf8424bc1c28d1520a4b947bdbbbe2
MD5 6e8dc07ff150b446a67d965dbabce97a
SHA1 75ff9bc1f19de4b7a571dee4ca284c396d112a0c
SHA512 416b9ca9a2c9b4429274ef8ff634ca814d1c3e62d92ddd3e2faba4cbb587e1b26f25fd18ce4b4d4f12f652faf68dfc57b8d8f1e649904c6cb59036abdd2c7c20
TLSH
T185C04CAB9465C79A4F34A9E9203C761DD50B938A8CE1CCE49548518523B8D235D17A6C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58a1c9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe58a1c9.TMP
Size 157B
SHA256 2002e5e62759219b9debfe5084b74f15744028be77cda3d2c7d5c9e92e589029
MD5 89fc84e692db626cdf29743f4d71d081
SHA1 f31cac9436b2261c9d0238ea18e4800b2f52bacd
SHA512 2b5a0153206c78d01a616daa6f124f11344ba4d9265692383740ed30d9ec935dc907f55808f0255b2e75f372406330c438034cf0debf90e19f55ce21a9b098a4
TLSH
T1C7C08CAB8070C3960F3068E9203C320DD11B8E9E8CD0CCE4814930812338D238A05A6C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f351200a932aa623124f9451b4367bb8fde7af6159d44d7e51b32a127f1ca580
MD5 a5e9bbd9819250a6a05c536419b527a0
SHA1 c33fb52fb83fc31f12ffc61c560d21a2d665fc14
SHA512 8c850272e1561d56447e38f916a5dd7410d8a64b280c840938646eaca97aed0a5b8a839edbcd44cc674cd76b53efc917092f43d66070e0df2b3c190992771f69
SSDEEP 192:uFLsNTOYQtMOa/M7FGJdQmiU1JgWB4MTQj+FdLKKSnGNll8z1rq7oQ:SsNTOYif7wJb4WukdeKS0lSMoQ
TLSH
T161422A726C785C37AEA3A145F04A37035EF4516BDAC42E94EAED5F0D01DA6AC130BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2eae72694272b690609c8b046b86219a49067d60f3a8cf7b8d8a7f78c27ccd54
MD5 1812cc8c68ff8a10fe8928703fdbeda3
SHA1 582fbf1720443a75743ee917cd87ba31f66731f4
SHA512 1d295b8a8704cfb5db6f29d64322bc79d8402133be668d18189ffc4c0051e2f8eb7f190cd231cf2f4bc3df333cbbc9c06870c131c4afbe53b1cd336e89f6ddbe
SSDEEP 192:lONQ6vMtPQmiUyvcThTQj+FdLKKSh847qWU/u:lONQ6UtRHTbdeKSJRU/u
TLSH
T1F9020836AC785C7BAAB3BD46F48A37171FE4216BE6911B54EAE82F1C00D765C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 7dc796d309eb3789aac8d4591a6d0eacfa0a2d4e1dd463eab60fc3bdccf0b791
MD5 0cb88e7e6cf775007495d3e921e8e19c
SHA1 d7ee9f28bde4b39152c2b8b028c4abb6c8825850
SHA512 309b4115708bf8cb85127f52f6d2adf7eacb52a9233a7dbedc87cbaa3e02d006478e4867eb0accb95a259463ba5d4749293148b01ac32baf55af6759a745f1a3
SSDEEP 384:RtNn/s3n9SfsNTHYif7wJbqWukdeKS0lxMLb:Rj+9U67fb4PMLb
TLSH
T179625B326C355D3BAEA3E185F14A37035EF8416B96C52E88E9EC5F0D01DA7AC130BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 f28505322617ae663a73f0c2c6aa75d1f6d61cdf59e1a0426078ed08abe61242
MD5 00ee76934dab7d1c23d4e6ba9dbc6870
SHA1 f22be058b9530ffce0d454051045742123ec84a7
SHA512 52180c2d416d9b3f63eaaccff4a4de708dc3fb1687a80802303ba4ef32816c0ce8928c0134522e3622ed004690614b9c51fd7a29d1362f1673c4217489f95a9f
SSDEEP 192:lONW6vMEPQmiUyOcJhTQj+FdLKKSnGNlG80Irq7U/u:lONW6UEREJbdeKS0lfMU/u
TLSH
T1D3121B72AC745C2BAE93B186F08A36035EE4916BDAC56B54FADD2F0C01EF75C1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 bef88e7145123729f890e8dda2c97f31e3de9d04cf190a70b61132f3dc9bd12a
MD5 b6f0630638b71f4c511f51d58cba1147
SHA1 f3645fc250272e1ab1667548c3c2bf0e1d4654d4
SHA512 7f17edd29aeb3e2a31f73f9dca1bc071259ea6cdda94626f58788ab9529601ad31d08d911c6afb701605875839e54a316dd7bfb8389bfd2add311c964c80d445
SSDEEP 384:itNn/s3n9SfsNTOYif7wJbqWukdeKS0lxMLb:ij+9Ud7fb4PMLb
TLSH
T1B7624B326D355D3BAEA3E185F14A37035EF8416B96C12E88E9ED5F0D01DA7AC130BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 479B
SHA256 df971de1d83c4ec8d8a5317c7da912d8feaad9129307ead7cac91d8819c039d1
MD5 60aeec055cd3bd04b686b14115275140
SHA1 226ad5a7a3c53e4dbc2166906cae70250583b691
SHA512 0567a6078a9f2c06a9054f75a9bf6b745ad3e3735d4b341e44089627a2e31febb2df182dfc3b521cc3bc180bae5d381bff6248f2806a7339a8f3037dff530336
TLSH
T115F0544E8C2EC994FE0955F500D5C3732415AC408EB55E7D6D0856D364861684CC9752
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 ec3587157f195533257aa45aead5c967201065e2d61e42dbfda0998acc2d3ea9
MD5 0627b174bc3f1028e4d09dfc16da3eb6
SHA1 88a8d887bde9faa09e5499fdf3b3e5f4f7635e44
SHA512 602c81c6532535b7b57378d5d1b6bec919651eb3138f270f2b395c4782cd2ac47b7a00e8033b3b9eead4bea2754586b6d3d6b05200c0c5da634ceeb083fbc9a4
TLSH
T1D8513C6939D353FF8D792E7FEB00D6647D58CDA41A63008086120AA449DB07B0C073FE
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1~RFe588ff6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1~RFe588ff6.TMP
Size 584B
SHA256 6ceedc75697d3ccb78be3a921ad5ca04ffa7bc6a98045e554c38172e89684897
MD5 37bf87bcdc22aefced8f8d4009acd07e
SHA1 d59477c8237135c1aed34185f153d77d56fb7eaf
SHA512 875ca0908db44319fac5de66f61f4dcf4412701c8401fd91734d9b2685c489a905a624c3604b263e5188780a69114264db75bae46f10528788b6d0493ba45faf
TLSH
T13EF047A72EF054D6773192FC93E94794A409EF56890301A90029C313DAF8769D510B3E
MD5 SHA1 SHA512 TLSH

Submit Download

271e6b68-4d95-4755-9d04-cfb2a301b022.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\271e6b68-4d95-4755-9d04-cfb2a301b022.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8df70c05bc3faf08bf6ca20c252145ee674ff41c6331e4e6d96262bde4e402f2
MD5 1f08a54509fb17f886a8458a05a05a54
SHA1 4f5cc6eadda39c972891340ad912f4fc482d3813
SHA512 fb2468470286490c468e121c0d1915e58439b59c31a3dd12033674b8a5444fe64972ed00375b000ad527de0a3cd29fe09b3a6acad62992649fd0f6857fba0b88
TLSH
T1C0412758B6E91148B3B76E5A9BF6A82D587FB8772E4A945E00110E4F0A63B00CD71737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads