hxxps://we[.]tl/t-PYB23FpxtpB26tcp

Analysis

user interaction
yes
max time kernel
31s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://we.tl/t-PYB23FpxtpB26tcp
Sample260803-psrdvahe43

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4740	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302341608369416"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{88222070-E7AC-4398-92B9-1B9544A1D55F}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 4172	4464	msedge.exe	86
PID 4464 wrote to memory of 1844	4464	msedge.exe	88
PID 4464 wrote to memory of 4740	4464	msedge.exe	89
PID 4464 wrote to memory of 1844	4464	msedge.exe	88
PID 4464 wrote to memory of 1844	4464	msedge.exe	88
PID 4464 wrote to memory of 3692	4464	msedge.exe	90
PID 4464 wrote to memory of 3692	4464	msedge.exe	90
PID 4464 wrote to memory of 3200	4464	msedge.exe	91
PID 4464 wrote to memory of 4584	4464	msedge.exe	92
PID 4464 wrote to memory of 3200	4464	msedge.exe	91
PID 4464 wrote to memory of 3200	4464	msedge.exe	91
PID 4464 wrote to memory of 4584	4464	msedge.exe	92
PID 4464 wrote to memory of 4584	4464	msedge.exe	92
PID 4464 wrote to memory of 2752	4464	msedge.exe	93
PID 4464 wrote to memory of 3060	4464	msedge.exe	94
PID 4464 wrote to memory of 2752	4464	msedge.exe	93
PID 4464 wrote to memory of 2752	4464	msedge.exe	93
PID 4464 wrote to memory of 3060	4464	msedge.exe	94
PID 4464 wrote to memory of 3060	4464	msedge.exe	94
PID 4464 wrote to memory of 1516	4464	msedge.exe	97
PID 4464 wrote to memory of 1516	4464	msedge.exe	97
PID 4464 wrote to memory of 1516	4464	msedge.exe	97
PID 4464 wrote to memory of 4332	4464	msedge.exe	98
PID 4464 wrote to memory of 3688	4464	msedge.exe	99
PID 4464 wrote to memory of 4332	4464	msedge.exe	98
PID 4464 wrote to memory of 3688	4464	msedge.exe	99
PID 4464 wrote to memory of 2180	4464	msedge.exe	101
PID 4464 wrote to memory of 3740	4464	msedge.exe	102
PID 4464 wrote to memory of 3740	4464	msedge.exe	102
PID 4464 wrote to memory of 3740	4464	msedge.exe	102
PID 4464 wrote to memory of 2444	4464	msedge.exe	103
PID 4464 wrote to memory of 2444	4464	msedge.exe	103
PID 4464 wrote to memory of 2444	4464	msedge.exe	103
PID 4464 wrote to memory of 972	4464	msedge.exe	104
PID 4464 wrote to memory of 972	4464	msedge.exe	104
PID 4464 wrote to memory of 972	4464	msedge.exe	104
PID 4464 wrote to memory of 4436	4464	msedge.exe	105
PID 4464 wrote to memory of 4436	4464	msedge.exe	105
PID 4464 wrote to memory of 4436	4464	msedge.exe	105
PID 4464 wrote to memory of 4780	4464	msedge.exe	106
PID 4464 wrote to memory of 4780	4464	msedge.exe	106
PID 4464 wrote to memory of 4780	4464	msedge.exe	106
PID 4464 wrote to memory of 4604	4464	msedge.exe	107
PID 4464 wrote to memory of 4604	4464	msedge.exe	107
PID 4464 wrote to memory of 1136	4464	msedge.exe	111
PID 4464 wrote to memory of 3264	4464	msedge.exe	112
PID 4464 wrote to memory of 4132	4464	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://we.tl/t-PYB23FpxtpB26tcp
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffdf873c188,0x7ffdf873c194,0x7ffdf873c1a0
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,1119225799535267241,5130129639699272289,262144 --field-trial-handle=2460,i,3587573395348573190,8482073961839500499,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:2
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,8633944357801222993,4073173100204312250,524288 --field-trial-handle=2460,i,3587573395348573190,8482073961839500499,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,7584778492278948287,15240637024959495097,524288 --field-trial-handle=2460,i,3587573395348573190,8482073961839500499,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:8
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,8114275256093664299,5075225573828459990,2097152 --field-trial-handle=2460,i,3587573395348573190,8482073961839500499,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,7175442049615495483,385987900580808914,2097152 --field-trial-handle=2460,i,3587573395348573190,8482073961839500499,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4120,i,18040343608248482056,11114070428880854300,2097152 --field-trial-handle=2460,i,3587573395348573190,8482073961839500499,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4140,i,2687788082367491196,15349663687019984956,2097152 --field-trial-handle=2460,i,3587573395348573190,8482073961839500499,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:2
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3516,i,1851465959528423213,3461870896044447207,2097152 --field-trial-handle=2460,i,3587573395348573190,8482073961839500499,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,7432313085241918206,9689382461857989212,524288 --field-trial-handle=2460,i,3587573395348573190,8482073961839500499,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,6226748068004639455,11672147161747181841,524288 --field-trial-handle=2460,i,3587573395348573190,8482073961839500499,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,39409057372336065,6405752518104915775,524288 --field-trial-handle=2460,i,3587573395348573190,8482073961839500499,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,39409057372336065,6405752518104915775,524288 --field-trial-handle=2460,i,3587573395348573190,8482073961839500499,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6268,i,6794216076331554115,9517072143360720162,2097152 --field-trial-handle=2460,i,3587573395348573190,8482073961839500499,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5044,i,3003088956146519992,17751207202630097108,2097152 --field-trial-handle=2460,i,3587573395348573190,8482073961839500499,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5128,i,9823594804551791878,9831317774796051111,2097152 --field-trial-handle=2460,i,3587573395348573190,8482073961839500499,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6212,i,18006278681496234969,16423073441855057792,2097152 --field-trial-handle=2460,i,3587573395348573190,8482073961839500499,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6220,i,4827112854507356989,14837368267384981859,2097152 --field-trial-handle=2460,i,3587573395348573190,8482073961839500499,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,13681378980569477197,9938246662040739492,524288 --field-trial-handle=2460,i,3587573395348573190,8482073961839500499,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,8024899732293792210,4651016220884643544,524288 --field-trial-handle=2460,i,3587573395348573190,8482073961839500499,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4640,i,6505354502772684078,6209884127968831520,524288 --field-trial-handle=2460,i,3587573395348573190,8482073961839500499,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,14646751343629827791,9944937628896446972,524288 --field-trial-handle=2460,i,3587573395348573190,8482073961839500499,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  PID:4132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 64cf7adf13e875b415330ac3657ce5672efbf3fe1e27d486548e17589aa3a1f4
MD5 53ba21c908061701ed89d58977fd5431
SHA1 22c15a7c711919b311779b49362665f68b242b4c
SHA512 21913acc2e29a5c12b144cefab51d67eeae1375155e130ca8822891a4e7242d8a5ba5b53050c45771e39f1a55d230820ad8d169ca80cd1a13e712d95b4bd743d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
TLSH
T1DAB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 17KB
SHA256 dd947eaffd7e5f7d842aa5f48e2def3b4c11476d33e0f1faff3dfadf458ab438
MD5 50e56a8c9850749beca47ad038b7ea68
SHA1 7d735e43b851dc4c1e0e85b1882509acaf81bb48
SHA512 c2ff335e105c5a9c1f288abd556ca5f44af3074bcdc2cf3d01ab6bf788e5e8db03ec7e0e52f709f1924eca35b35a3b7305889b4cbd3ed4e79220bf7d7f2a8c74
SSDEEP 384:h2n2kVco//aietVMy4Xo9axO6Xow8D74eCojDP68nrdI5xDhH:41+I/MVFl63i7bJSQrdI5xDhH
TLSH
T1D582C07F4F67D550467EB311D395024A3B15359BF26E6CB0B36E8628732399484CF0E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 28KB
SHA256 c09f3730b4d7ac91af08e3ebb2c0d6e7dd0e869775868316ec6b78ff25977279
MD5 2e1fbc820a9a2ef56773f33938d05561
SHA1 b97adde27b21d93b4274485c95bb7213951524a2
SHA512 7f341bd5691226754e5ce290eb6909d81e4a7fc465be9c610036fc04cd7db7c610b6628e2950b52806df1b9e877b7b35a2251dcfdbe64daf8ec67651d2b80b0e
SSDEEP 768:ngAKh3KVqngCQyjmSa/NCGHQ/ly0B5ibFzt4NM:ngAKkVIgaal3w/MkmzOM
TLSH
T1B9D2F14ABEDE1932E32B84068663F6017408DEF5BB0F9154B8BD6C0B7441587B117D4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 28KB
SHA256 af96e4fa4878c0d8f75537e2a5afa2430169e62f87ebaf0a75067fa946e3084f
MD5 2c581d338d2a177bedb30b30fc003afb
SHA1 caa728d2dffdb1f78b53f4e188bf842397978893
SHA512 f25cf317b2e74a9cfec9d4241a35b300ce53d2e217abee7da8089b790d5e73970715ab69360231fc6756bedc2bafbb9b714e5881b272d1fb3655baecc0813b31
SSDEEP 384:hlG/E9vZjUdHzZ4390N8BjFoRm/N3olXm/bGqEQ/uqvYA6QC0IiFssXe4gBIOC3M:hQ/EtU4t0N+jFhSmTrELyJC0Nss/VHin
TLSH
T118D2F1B21C7A3613C4E7A1F2DC6E9D49D941B6830E09045C9BD9082B73DA12ECEE7DA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 21KB
SHA256 a91efe6119d1b419dc00ae6640654cd80363ead938cf82566c9a23e7b167cbef
MD5 706e4ec4dbbde940eb42ae49bb86613e
SHA1 8b28194f7093aa9a13f6a32bdcba07d6c04d5943
SHA512 7cb2148500ffdc5d25f0398a4fa21fffeecb53f2e1d4f378552911ad4919fb8f3a136f3197df43dd1bce757d78ebbb3075838f67adecaab450b6ac590d72a569
SSDEEP 384:3l3xvU2CAai8J18EW/HxyZpsnNycJFSQRcEknwTM/H76wVsbM3HsI7uHWHG:V3Jai8TV4RyLcz1R1kwIpVuM3bkN
TLSH
T102A2E0D8B0C0CB7C9886743A558A9B4BDE185A72CEE5960D5F307CC05C1AF3C256BBB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 29KB
SHA256 1982b8feacd965112fec5491ec80bf7d5ae8364e788d3fc77856b34d0ebcdd2b
MD5 8b23ef15867600c1f7edc51381e07c87
SHA1 7e5c51407ebe2bf21c63789f50d7e91371dc9312
SHA512 28d8b823993a9fe6e143f804a64eff3350941f37c9031d12ddb21e2886e1f54a5e2ac72865cb26117efdc0719c0bc6bea5b19d3803488a2ccb24f8ec7a4d9c30
SSDEEP 768:56x4CszVn20mga4RrhKvr38RTy1Zwg4nwXlZAMJSZZ8ttlCltvMwX:56IZ2/pJr3Ay1OPnwXV7lKkwX
TLSH
T154D2E146EC81DD6B84696668A389338A0AC5B5D3D085FD3FB3BC0315D98637874E298A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 51KB
SHA256 08642c062f31dd76b1d6a036c7dba63c4a1014214e5af5fa73af954bc66fe0b6
MD5 654d2c8ec450ae4f220b10ddfa98bc77
SHA1 cfa95941083ca95c0c4d501c615c1d0582ae9581
SHA512 64b660183eeef4dcb3d2d5770c6bb551494fdeeac0c97afefef86e8686baab01ebbbf4233f7e8d5d988319b558f75dde4a5deee6253b6b238a03ca8be8c12cd2
SSDEEP 1536:zTHCTtGzCr6Vp3qe5X0xQW+WSOmWY5XYl1K7E:zTHWt8XqU0xX+Ww5XYloE
TLSH
T1B63301DE3CB26D6B1AC2CAB134644E2C1577B38E4D920D5B6D8C09998F8DB1C81361FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000091

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
Size 46KB
SHA256 69af4667e162140fe85dbeab28f5abc125018c5e3b9105624d74150b6cac2692
MD5 f7ad8a800acb47e0196824124b6240a8
SHA1 4b0d4b72dbce8d42c502b770bebdef4e75574202
SHA512 213e387876108eb1dfccbd7b14177938dcce4247e2ef86030ca8e8c86c3e72d1a80f7f70a3b2a26bb7e3a9d8384eefb427245cced9a95cf22fc0c8c33635e3b4
SSDEEP 768:fVMQFiTaaHdzE5DIUKYRbVqRoFDEKL8f266IAWnbjjVVUJECZzCyrOdwYsh7GFGj:uCKzQ/RpCvYTQbnDUJECsyYenjH
TLSH
T13D23024D5BE1765849DAE242C3EB18A839E141D221DBFDA470CEEC4D870560B12EFAF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 26KB
SHA256 feada753368a8a6906ded3c40cb6fad551c15ad97c2c897acf9095d4da066e25
MD5 1f4a896662e44b34a8d78df240665f59
SHA1 466d05ac1b8de5846673da79697b4513c2a3cc84
SHA512 bfff74df17a25fcbeae57854fa7e3dd299e88659cbd07fe0f32cf28fb115c31758a6a165481162a89fa4ff76a4d854d08a29b4f8f1053608a655d1a7a6fe5558
SSDEEP 384:AmX3CNQxS55ZFJMarg9APDlxbTg6ndVJw0SK/MoZX7l+Mcq6V1m2X3xvN5S4imsT:rCKxSHHJBM1Mdbw0z/PtMFqixKXT
TLSH
T111C2E1102FCB8AA2D0671EBFC50A3CB7FEE5A890464C1161755B5A53F32899A7DDB404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
Size 32KB
SHA256 cf6df5565b10ff9009cd27fd29e5f4e5607b69ff051b79f2442565ec3b1b61fd
MD5 a9b6d1e3c2e0fcae53b79b885c780d28
SHA1 09a61425158e8eeb6697ee674de1ede5e68d8194
SHA512 2a01354cd779299a640b7015c8c5f39b5ba043691481fa6884444a6f1cb572a588b7b9ef6c18013b22b8583df8310028590c16850047284c76af8dc629538328
SSDEEP 768:dhmlcS/Sz3xPlorpLWYTUPxFEXz2xivQueiLR4tbSg+RQKyDoAhefMi6MpCw3B3v:dh/0SjxcAWXz2xliLRZMKXA8t6cpv
TLSH
T145E2F14D1BD0818CF790855761977D6962E3306D8F1EDD0DBA2224C6B22A2B367F878F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 36KB
SHA256 0ae613d91cdf4b1c166ee1c7b741637338db7e77b5e7b6af74140f5bf27510c5
MD5 0bbc8ed458a0868a107fa6674151dc2c
SHA1 c68d7ef297d95c4ac48a631ce538690cd824bfc8
SHA512 d203b9ce769db826a957349feddd4f3a1e1747cc03d772d698e3364cc55c404b452f3132976cc0fb6e9188099da109bae5362c4507fd38ea78f4d9bf83be3028
SSDEEP 768:HbYGwS6QBK3/JyUg+b0h1LV8IKH9eYAlJZBEuuW4iPgq3/MmToDYv:HDwS6Q0K+b0h1h8IKYJE1rj6MmTo8v
TLSH
T1C0F2F15BF579815485BAE3E8A9D34D743BC038B332DF839206CA9D138FBB0595963079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 32KB
SHA256 98cf3869356ccbbd334ca14257648461f9a97d2eace99a77ea181717fcea7a94
MD5 168df395acd02651d094373da85fc54e
SHA1 650ea9dcac795c4090342fb7d0cdfc396a02cdc1
SHA512 16c1520b14a10965c45de502d68f5841a018cd96fc14b2cd32d590f5c7284890471012e9cd90e37670e7a55d7c8900359d9d425790eb86202b49fb84044d9aaf
SSDEEP 768:cEojFdSQf2oMLtRdutchIyKPZqZ4jzqp33MRiPrOfN2oWZt:cEojGKCtRdutkoZC4nY3EizOfsoWZt
TLSH
T148E2F19F22A83C3ADB2246B9C156B98743C017A5A1CC0FB9C899571476FE5D0B02DDEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 39KB
SHA256 cf7946071d5f21d7a44416dd6316ac10df6b6f7389987c3f953ef425a38d1eb3
MD5 812832c01eefc81bbb915d1f325c80e7
SHA1 f0fde2672b46c11e495eb760106f2f4c37b9975a
SHA512 d270632a40b7302e3cb513e76e675337b0c2d0a1a4329b566e722171ebacdea598ad1a673144414b2ffc5f1cb7eabed50ef71be648082b671ee820858e92d4c3
SSDEEP 768:+G0lZFMpidEtkTvA5xFhs645eqvkZfRfGfg1F+RCF4RhROhTPjbRPkFYFUq:+PpZEtkMxFa4qvURfGfgDos4RUEYFUq
TLSH
T15303F15CFAAC4D92FF1B1C68632A6B7A6D2E96E2A07468153D7747F4E0EC203090573D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 60KB
SHA256 9e75865c288564ac228ccef227c835be96b67ed0a5735075ab06120e4a921237
MD5 9848e4e975aeec940f06d0ef60814524
SHA1 1920beaf50426e4bdbb67b9b5db0630abc183fec
SHA512 7a4d65d67b8845d17c27170742edd03d83dceabcca3dc9087159252520c8622cd53cdc8108896d7def737755f9c9005a71f5b4d21642665233fd8fae5c4c88da
SSDEEP 1536:3yFtcmDCeAFMJUWPGCIoPsNuewIG5jIqCf8PU2b8EMO/cXX:3hmDCeAaiqGCPo5w7jIUr3hUX
TLSH
T18F5302FD0E9EB7A381472FD5615C1CA38A348D36000E9AD5C1EBB9A1316631FB395A7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
Size 46KB
SHA256 366339275690bef948a3878aa22ae1cc0f6495f27a30fed5732c2e0981364b1d
MD5 883b2794249bef8ca67b36468d0f12b6
SHA1 dd0c18880c7006174d4b6155ad940687485bc4ee
SHA512 c7bc0de95ebb71dbb97246749b7ba7d1f45f211079a62ad194bc7c8f8e9b67c2256f804e0c8c922871e2b0fd7459a5c4cd6c17d4a1ca6fa455f350581422946f
SSDEEP 768:SeGtBZk3Qt3gxKWZnkI2q339wxz1gwDeU5/g+KTv9Qm+7tGTKVMglEdR:hGtBZk3QtE7d3tszCwDz3AQm+QVglKR
TLSH
T12C2301160CDA7C834C830702A6B05306FD4C52E0E63D3BAB2C972A6063953329ECAB2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
Size 93KB
SHA256 928ba15f2c4a15f12c09402f3b918656b3169594d1c2bc7c912e90f152a27abb
MD5 075c3b0cc979cc8b8fbac2f3fc0c4e90
SHA1 15f3f344e0835a8242f6c83fe617a28536ea65f2
SHA512 ac7dbdfbcf72609ae1415ca5d8f162fe1a194d59e00ab687da252891bcb5d8f73d88af5539ba303193cff91e56be77f36e8f1dda317ffea430475ca08ff145bf
SSDEEP 1536:DSAmNDYPFswelE2ZIZTZNpoMnwHNHiAIITn4621w6eAy15Zd56iKa81Sei4vHrGu:DBmNDIexIZTvpoWHAIsnGy15ZDRKadeN
TLSH
T17B93128B14D11B139EE30A306D66DB0C269503A8DBE78DD9BA737782764A1F3C5AC073
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 76KB
SHA256 f3defe9760b5e13b351dc4cbcb58a6340d6bc7f8010d6e64b0bd43f7e971f9ba
MD5 f6072d61ca03711f94a15df46b2bbe0b
SHA1 2689209433ad8945dcc519705282a61ce6a5524e
SHA512 be367509d2eb860d50f06c92e666c359dc8dc11dc904581047da51dd66b5aa6b1ad41b65b54c33c2cca731da49da8993e8636a200b02933a65bd2c3a424a0d68
SSDEEP 1536:IR8BgoZE01NKZ1aYo7hVwc9zi1fsi2wOQk/3A2chzFQLNH:c8PE0vq1XmhVwUi1h2ro2chiNH
TLSH
T19F7302D7CF362ABAAE729009576D404A963DF900DF69403A887FFBC93F470A11A10376
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a1
Size 76KB
SHA256 218445a5832e91ab5bdd3093e16dbf9ea98eed4b16b43feff9b523d6a7757ebd
MD5 1f60cef812ba0f0b823f45287e626409
SHA1 f8779c73e985c512a920c30c08db35a34885003c
SHA512 05295f99e4f1c9b444bc641d6fa43d198295d5c73b67f1fac5c2676d6dd47cb9fa5abbe39c8ca9c71fcd31369745e0bbd1c1d76a27e1874965a9110203dbfa1f
SSDEEP 1536:OhaJM6W5vjPwys5PQZWfzI/pqPYXYQgy4gA7TM30o8zdZWN5C54:YOW5v0ys5PQoI/MAIQgy4b7okr8
TLSH
T1507302CC4BC674905AE30E4E6954D67B8E9DBC674D92886316DEF0C43A316AE533C372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000af

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000af
Size 244KB
SHA256 0f21f6ceba672ab992095b3af2a51aa27560c7375cb390be77d78d0d98f376e3
MD5 8be25857216d9103be6c64e1dcb6a997
SHA1 f262ec35cbfbb3232a28d98ba8f418361a9d6424
SHA512 ea84f0e7be1713965e846371d855d86ea13954eb6581dc9f89e4617bbff6f37e1ce47971d4146469a5c9a6856e301f06c88ce38c2472a16e09561cd0f636d634
SSDEEP 6144:1oYlMX7QiPlIE5lhMLuGNffMF8ZLBg+T6zzIH5q479KOb2Sjvgb:1oYuQNE5lhMLuGJE+LBgw6zzn479K8Mb
TLSH
T1443423195C1B50FDA8F76C7958334F36692374D5BBEA98036BE0871132D3409BA74CAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_triakonta.wetransfer.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_triakonta.wetransfer.com_0.indexeddb.leveldb\LOG.old
Size 369B
SHA256 2b08f511c5dc481c5d1d9f3140bf7a0918c8bf7f36bba77269a3d808683608a2
MD5 3ae60272ccffa9301df9689ffd14bd7f
SHA1 d476481340f480f3adeab2679943e98eae6311d7
SHA512 b1118aa7f023df16d8f155da677d164968783df70b2d4853ef36e4a7cc547474a5f14dba49e8d581f4ace6f5d8f8788d427ee8af6763377aa7803ae97d1e88d9
TLSH
T155E02BACC4C8812F511056D25278BB0D91A7E70ABBCCAD4D4F00CC50F446084D05D591
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_triakonta.wetransfer.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2bab8bae21e2f94b96f6c1c8a706da03cecf7400086b36578c7148817de4637f
MD5 64440ecff2f7751a78fd5ea62e21a944
SHA1 adea5ba6b009c7f64e4f2830a27711aa7bc0aaa2
SHA512 efa41c075e33e1a65c40cbebee58a8e064c3d6f50940df9f00773fb8b20e3498a8c0b2295be3886b4d09ba7d77f9dfd94b697c2563ccc719d8856fdf700e12ec
SSDEEP 192:sxZoRbyM/jK1Ml8MkH/f6sv50zIdpPvHW6+WNfiv/YHv2GmIgrJ:sxZovMH/f6sR0s3Hb4/X9
TLSH
T15552F9166A386977CCCBD209F945BF53D6F90472A2900E4CA9FCD91C04E6BED620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6214d924441cb9f416e9b399de662a442713d7fe3f9728bdf07ed6d721791ab8
MD5 23edec96c1a87bf7a5f538ab39b3652e
SHA1 78e3b8fb66c916c2daf133fe3ed3045ca6b077e7
SHA512 6aa0ec201063be28a15b7a3f9d44b89ddfe8834a6af2891667c3e956207b48862798b6cf187e7e166e438e175ca08965798f7fa5dc21015738aad074cffed846
SSDEEP 192:sxZoRbyM/jK1Ml8MkH/f6sR59T5IdpP2HW6+WNfNjdYHZeGmIg5CJ:sxZopMH/f6sL9O+HbZdfM
TLSH
T1BA52F9166A386977CCDBD209F941BF93D6F5047292900E5CA9FCDA1C04E6BED620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c79ff9764b0a50018590149b40c065b4be097b1382ffce8eb8932b53d922bdcc
MD5 95e80ab560d25fe8a7c113f4395d9d6b
SHA1 2728294fcc5a4d813426dd26b84aec944fc60a81
SHA512 b044b3d2af7a2d9c0c9d8f8ae96d77cdd6346211bf1d6cce994615fb53989b6400958d989c0f3c0add6f3eddd41cd6ecb9b7dc520c70303ad13297b686a6497e
SSDEEP 768:7aUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RMroV00o:7aUZYTMWvg0Pou1ja7eLZmRXNo
TLSH
T10DD20A2F284CCB7E4F844E9DEC266F963ED801CB5A584D5447EA884C03CB6EF512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 1b6dee587ff4b2005fe5943a82262343a3542f0231865ab865404c41edb44414
MD5 7f8953d04c813924f6584c88482450bc
SHA1 4c1ca012bf0de8f7992a8e62d2ff1ae28d4a4828
SHA512 95bac8d35fc5bbfef7012e6a21efefe539f13ad8ebc919d065c303e0ff0c8e3c3c2689dc0ec8068a81bbe5dea837ca9a206aee1fbfc6884e4fc72cbb7484245a
TLSH
T1A7B0124380192143D40441F08185158422EC082413041153147450F8D4211D802D384B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b61c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b61c.TMP
Size 72B
SHA256 d433123f9207688c9f0e8b14caba2c9167d5f91d2954cda6f69c24c9fbaa9a96
MD5 9fc3fb4b4dae354e878d4c5ed84d863b
SHA1 a1edc761f13daf4e971c122251872a38dea6285e
SHA512 a94078766cab6beec4e9d744a5546e1c619f7726c67ba2c5ecae2e2183a4df6fdc6a48b17f8d47d97a5d0784f8cd2c99760e2ecee69cf765f109aae0be43891c
TLSH
T160A00213C3CA140CD40006F1901722A093A08C59074016034495E0E9EC920D0956194A
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 b6f313b03a0077010d4b201a7fc649745cb9cc214aca04604d4ecd1038fe6e9c
MD5 e51e26d02083ae1a80c49cb004107609
SHA1 a763e79c503aed0175b7e3bcf7c3595547dd0e79
SHA512 4d66e2b108c1b57162857969006e3a71f66de3efe9535de727c2e9efd13a88829916f043d5f700ad25705ee7a88a36387e30fee3cfc1e976a6db8a7278e75c9a
SSDEEP 96:KA1eK2AkWcKjCGm7mKM47iQKDKq25mKy4y:EGbdzHFz
TLSH
T16ED12B5271B7D2123C3D2B0892D59766DE81F1A3701CA4AB7B6D11B18E2BD209DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\958796bc-d9c1-4ed5-b2ac-86ef172d863b\0
Size 38.7MB
SHA256 51cf24a59f519dd2e50f876991cea1ef4dfdb33eb8d57af3a38485f5d25c9e4d
MD5 58657370c8727a815105c540f566cf9f
SHA1 efe059514de1811761999b24d888c55c45dee2fb
SHA512 3028471a5431dfdbbac747048576b699edb5f172b833e5c73b8a967699423dacececb59d71f473d9010b554db054bf77adb35bd050ebf8918f52d4e89098c5a9
SSDEEP 786432:vXaMbnp6TeoYAGuZvdtyR96ZjKL+lb1nqisio:vXasp66MZVtkOo8bVqBn
TLSH
T1B29733A9AA212879ECD83BB11C8B753B93F530ECE021E055F57A2633D251F92CDB3558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4d7660784c504842c9d85d72367d1490bc0a53371ad6d33188c6b700055e69c3
MD5 c2ccb196ce34b8b04368718387fb7ce3
SHA1 00257605a18ff3a55ec8082e2af68a1fa6af9944
SHA512 c78e580d37057d238338b141834bdbbd374e7117e32f26bb9977f01d38a24a8270452a2c6b59f23bf04875e22a205e79bfc68526efc7715faf22b92b893e4789
SSDEEP 384:4ZcIhsNewPon43BhzX5od+ndiV+DtJr/SDr6HlytEDq1wKDW:GhYGApOOYCh/2oy6DqSx
TLSH
T12D927D3154B858369DF7F445F44739139EF89063EBD82FD892EDAB2C04DA1E9130A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 49326111e289e6278f7a920a823cb68f222cda03c7d0358923ab8919c242235c
MD5 5d6bfaebcf22875fac24eb2e76597e91
SHA1 028dfcfe9ca7ebc1c10483275cf107a8b5e336e1
SHA512 9be2383849e43456b285972957b3dd37c4e6e454c8e0bcdba4b12305aa710a63fc8b6636737562487a9cd40eb29d10c063e4d82fe1a74712492b1f8ea272eeda
SSDEEP 192:yONR61VWQmiUywhgGX5Obd+jA+Fdg3ao+j/a43jsU6:yONR6WPgGX5od+ndiV+mUsU6
TLSH
T19502E73569687CB7CEF2BE4AB48737535FD42067EA952F84D6EC1B1C009769C2306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3cec553c4a046744c8d2cf916fd6141da0781d0daec0f34e8e7370ade6fe3135
MD5 4074682894b8ad1f02b631ece5faea73
SHA1 50dcffa102811d1657c44d06af62a82d5df37939
SHA512 8b6b27a0cd2653a742f2304aa965a9dae7ee31fc8399037eda2d14827e49fce793ecce3d77bcb83611a38e58937f0d6428d7c9dbacd580cf76c265ecb2b780c0
SSDEEP 192:1ONf61MWQmiUy8hTGX5Obd+jA+Fdg3ao+d1ySJrzjJGqGDrU6:1ONf6d3TGX5od+ndiV+DtJrBSDrU6
TLSH
T19D120B316468AC7B8EE3B445F48736535FD55167EA897FC892FC2B1C01EB6AC130A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b013f8acc959a0fdae6176dc82f9bd28c9eb90a5eec3a3e2e1b899a7b2d03dd3
MD5 c4a79e20dbcc96fbbf06f25680152790
SHA1 8bfa2681ba65f32d3c2cdb22515b72df8cfe5416
SHA512 07d5728db1f785758bc1e14d86591805adae885ad06bfa3c1423537ecac495db0769738da1e573deb7e60416b6d09894b1b8084c8776d29ef3434852b7a6a0bc
TLSH
T1B8410758A6FD1148B3B76E569BF6A4AD48BBBD372E0B945D10110E4F0622A40C9B2737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads