hxxps://link[.]edgepilot[.]com/x/a5aV1uXfi5VzEDJ4ZNhbKQ?u=hxxps://we[.]tl/t-nK8RuD56qNHHpEeH

Analysis

user interaction
yes
max time kernel
60s
max time network
77s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://link.edgepilot.com/x/a5aV1uXfi5VzEDJ4ZNhbKQ?u=https://we.tl/t-nK8RuD56qNHHpEeH
Sample260922-whythazfjd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4552	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345733735987419"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{20DC7628-74B5-454E-B0FC-97CE7C55C05D}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 5564 wrote to memory of 5228	5564	msedge.exe	88
PID 5564 wrote to memory of 3904	5564	msedge.exe	91
PID 5564 wrote to memory of 4552	5564	msedge.exe	92
PID 5564 wrote to memory of 3904	5564	msedge.exe	91
PID 5564 wrote to memory of 3904	5564	msedge.exe	91
PID 5564 wrote to memory of 3844	5564	msedge.exe	93
PID 5564 wrote to memory of 3844	5564	msedge.exe	93
PID 5564 wrote to memory of 5328	5564	msedge.exe	94
PID 5564 wrote to memory of 5328	5564	msedge.exe	94
PID 5564 wrote to memory of 5328	5564	msedge.exe	94
PID 5564 wrote to memory of 4436	5564	msedge.exe	95
PID 5564 wrote to memory of 4436	5564	msedge.exe	95
PID 5564 wrote to memory of 4436	5564	msedge.exe	95
PID 5564 wrote to memory of 5748	5564	msedge.exe	96
PID 5564 wrote to memory of 5748	5564	msedge.exe	96
PID 5564 wrote to memory of 5748	5564	msedge.exe	96
PID 5564 wrote to memory of 1824	5564	msedge.exe	97
PID 5564 wrote to memory of 1824	5564	msedge.exe	97
PID 5564 wrote to memory of 1824	5564	msedge.exe	97
PID 5564 wrote to memory of 4132	5564	msedge.exe	100
PID 5564 wrote to memory of 540	5564	msedge.exe	99
PID 5564 wrote to memory of 4132	5564	msedge.exe	100
PID 5564 wrote to memory of 540	5564	msedge.exe	99
PID 5564 wrote to memory of 4852	5564	msedge.exe	102
PID 5564 wrote to memory of 3812	5564	msedge.exe	103
PID 5564 wrote to memory of 3812	5564	msedge.exe	103
PID 5564 wrote to memory of 3812	5564	msedge.exe	103
PID 5564 wrote to memory of 1156	5564	msedge.exe	106
PID 5564 wrote to memory of 1156	5564	msedge.exe	106
PID 5564 wrote to memory of 1156	5564	msedge.exe	106
PID 5564 wrote to memory of 2384	5564	msedge.exe	107
PID 5564 wrote to memory of 2384	5564	msedge.exe	107
PID 5564 wrote to memory of 2384	5564	msedge.exe	107
PID 5564 wrote to memory of 4548	5564	msedge.exe	108
PID 5564 wrote to memory of 4548	5564	msedge.exe	108
PID 5564 wrote to memory of 4548	5564	msedge.exe	108
PID 5564 wrote to memory of 3452	5564	msedge.exe	109
PID 5564 wrote to memory of 3452	5564	msedge.exe	109
PID 5564 wrote to memory of 3452	5564	msedge.exe	109
PID 5564 wrote to memory of 3320	5564	msedge.exe	110
PID 5564 wrote to memory of 3320	5564	msedge.exe	110
PID 5564 wrote to memory of 3320	5564	msedge.exe	110
PID 5564 wrote to memory of 6040	5564	msedge.exe	111
PID 5564 wrote to memory of 6040	5564	msedge.exe	111
PID 5564 wrote to memory of 5996	5564	msedge.exe	112
PID 5564 wrote to memory of 5996	5564	msedge.exe	112
PID 5564 wrote to memory of 5996	5564	msedge.exe	112
PID 5564 wrote to memory of 4940	5564	msedge.exe	114
PID 5564 wrote to memory of 5076	5564	msedge.exe	115
PID 5564 wrote to memory of 6028	5564	msedge.exe	116
PID 5564 wrote to memory of 4104	5564	msedge.exe	117
PID 5564 wrote to memory of 4104	5564	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://link.edgepilot.com/x/a5aV1uXfi5VzEDJ4ZNhbKQ?u=https://we.tl/t-nK8RuD56qNHHpEeH
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffaf23fc188,0x7ffaf23fc194,0x7ffaf23fc1a0
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,5082431119040266049,15048983537656472384,262144 --field-trial-handle=2488,i,11192878138713326447,3715207425744758994,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,1235243789762169786,8788556367852708214,524288 --field-trial-handle=2488,i,11192878138713326447,3715207425744758994,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,15328399929877166114,18426165045757871924,524288 --field-trial-handle=2488,i,11192878138713326447,3715207425744758994,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:13
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,5038296949452037301,2942568906551557294,2097152 --field-trial-handle=2488,i,11192878138713326447,3715207425744758994,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,3916995646401971144,5655918111726131779,2097152 --field-trial-handle=2488,i,11192878138713326447,3715207425744758994,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,999702705457970589,7890759887982353703,2097152 --field-trial-handle=2488,i,11192878138713326447,3715207425744758994,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:9
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,7424148148163528752,16391056377436526812,2097152 --field-trial-handle=2488,i,11192878138713326447,3715207425744758994,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,15769084985713390355,10206746443571304296,524288 --field-trial-handle=2488,i,11192878138713326447,3715207425744758994,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,15669248340146727644,13879465518933171113,524288 --field-trial-handle=2488,i,11192878138713326447,3715207425744758994,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,4948112922278873312,1628038157491377985,524288 --field-trial-handle=2488,i,11192878138713326447,3715207425744758994,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,4948112922278873312,1628038157491377985,524288 --field-trial-handle=2488,i,11192878138713326447,3715207425744758994,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6260,i,14333599718015208629,6277562577150012466,2097152 --field-trial-handle=2488,i,11192878138713326447,3715207425744758994,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6788,i,6473596632807866460,2294836427248111707,2097152 --field-trial-handle=2488,i,11192878138713326447,3715207425744758994,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=7016,i,7956864103927202254,3142615629864067345,2097152 --field-trial-handle=2488,i,11192878138713326447,3715207425744758994,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=7220,i,3316520770732716376,10983336154886956944,2097152 --field-trial-handle=2488,i,11192878138713326447,3715207425744758994,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7364,i,7602401538397446058,13145910828818824216,2097152 --field-trial-handle=2488,i,11192878138713326447,3715207425744758994,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4972,i,13554735528550582905,4729320535426963771,2097152 --field-trial-handle=2488,i,11192878138713326447,3715207425744758994,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,17472676741907705418,4799514597091757058,524288 --field-trial-handle=2488,i,11192878138713326447,3715207425744758994,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:14
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6760,i,8893199160437067419,17027438970457233966,2097152 --field-trial-handle=2488,i,11192878138713326447,3715207425744758994,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7564,i,5360912715651012127,5142168535338170679,524288 --field-trial-handle=2488,i,11192878138713326447,3715207425744758994,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7576,i,103371680215149522,4417315127908216902,524288 --field-trial-handle=2488,i,11192878138713326447,3715207425744758994,262144 --variations-seed-version --mojo-platform-channel-handle=7620 /prefetch:14
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7572,i,6984652460770786226,5612041067871269913,524288 --field-trial-handle=2488,i,11192878138713326447,3715207425744758994,262144 --variations-seed-version --mojo-platform-channel-handle=7664 /prefetch:14
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1592,i,3039297539532547299,5327591954136843756,524288 --field-trial-handle=2488,i,11192878138713326447,3715207425744758994,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6348,i,13423181782865127445,13261051713231043848,2097152 --field-trial-handle=2488,i,11192878138713326447,3715207425744758994,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6128,i,8148963680645213761,11148689615006067793,2097152 --field-trial-handle=2488,i,11192878138713326447,3715207425744758994,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6996,i,11711278773146398756,12142151701233471926,2097152 --field-trial-handle=2488,i,11192878138713326447,3715207425744758994,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6788,i,18246716401187946844,15444023683897060867,2097152 --field-trial-handle=2488,i,11192878138713326447,3715207425744758994,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:1
  2⤵
  PID:1732

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 48KB
SHA256 2f8841cda416c1e1eb997ea721a77b270471f3b6715fb62a5598d4b3ee158513
MD5 153cc21a36f7f48609ed630c0e0d8c2c
SHA1 d3c36daa4d296b0045a1d3de0bec179c5540b008
SHA512 358c45a0b61c43810cb2f6c0af3cd5c404f8e8f7d71492f34170f06e53aeca76bdde068ebccab12efadda4ba30d177f0a38b9c354c09a90783fb14609eac399c
SSDEEP 1536:Wl/ktfxJS5qPhZnESufAyiZOz+olYT4SDmfGv0:WRktZU5WZnESufLion6LDmGc
TLSH
T1D123021468243DECBECE414C5A3528937757BA34D1FAA20491670FFBC8CA94AF146FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 98KB
SHA256 6aa72f480a631a474ebd1e480c64552f02dbaa653811a7eb581c04ce03ece8f5
MD5 2fb744a2cc23d642abce8f1b6c9a129e
SHA1 fbc2b7a882aa167a3141bb81ff753c070effa31f
SHA512 c3d10da8c19e4c9110ad11d88c4aa2e90dcce2f3c860e5421cbfb694877a2aac73c65307070dd870a227f16be20b827d1d52752513e52cf738a2a2035ec8aa8d
SSDEEP 3072:2fJXl2Dt8SgPv+Xvv18ChAT/IbVi+tdCLOL:8TcDgX+/t8Ch+IotLE
TLSH
T11EA312C42CC4B4C2680397D94CEFCF1C9872696921AB19F8FE70BF8A555652231F693B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 178KB
SHA256 fc751a2be11ea62edb4fc50646ed557ed56f51f7891f286ce3ca6bfc5412dda7
MD5 714bfd88942e820aed5edf5fb5c048bf
SHA1 2066403097ff54a17e51fe010fd0458998379657
SHA512 b4d66fb37bb2329687557f37047645deb26e85911fe5bb97d03cb3c12609b18e5d166a16ef862a79174978b9b3502a590b95ee72502141e4cb4d80b0f2769846
SSDEEP 3072:Loqv4DHe/nJWSgt24IB6vadZBGRJVLhVKkrwkNor0/GNmyW8Jfj3m1pBOaCuQA:LoqvCefetzakFEVaowGCq+WhLA
TLSH
T1520412A8F42E4525150140D40D55A77C926FAB896FADF0F53F5C208FC7BE1EEA220D9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 16KB
SHA256 386e2ec0cfcddd5e2a59311de1081251de2cf70bf16dd52e8db4821ee061afc9
MD5 7b40547a18fae324d326d9ab0b1697a6
SHA1 d74d7824b69dd5e0965f2bb2bd8074765e4497a8
SHA512 ef652940054f074a197c4f01628966ffe19bdf85b0655b426c3bed071687a6b058a68731a58272612f7cf6b50d3f9f0f21768fe4a715c45cb609e6dd1770ee43
SSDEEP 384:ua9WPPYozN9ojZBAitmejpyge3S3DpSTOw/+HK:uacQozToTHDrD9iOYGK
TLSH
T14872E00D25C56C9CC17B05CBFF8A437AB471CB3AB9836CCFE495F56991478960242D1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 259KB
SHA256 721f0f5b3638a7bfb78307d0929de4c432b7ae7fecab41474c570879acb98239
MD5 6405d74f796209928f7fb0adaee68cba
SHA1 94852b0f107654ff4c3e4eeddf9b800038353466
SHA512 1ea124c9dcf71e73e20a5d5e972ce653dfeaf40ba21c446a32bb10892f53dccb247bd3186f34a7c661ce132264e4a828e94952d8f5adc9cef2686e3025fb5c28
SSDEEP 6144:yWhGAuoTlzU19ycXo0RYF619O8KvCFAgkEOsOBp++f5qRYXrQ:y+GTWwrM6HezgDPBSqRY7Q
TLSH
T11D4423DF5A7C975FE3EBAA3D7CE9179E380311126214672A69913F12B24281B1C8337D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 185KB
SHA256 f78e6354d279682b65119afaf01470480899d63742af0da872ca2f999306b1b2
MD5 e030ad4a207df8a15262c423c43cae99
SHA1 9605aaba0771ee5980715d6d0e001c1308cf5f35
SHA512 6a6c37e4286d058dbb07ec5e972729c8287a16315dd50b02b5a668a1f713262b11f1aad82236281065e5aa30937e5c88e553d4048ecd3361ba9be1f928645174
SSDEEP 3072:MvcF6tkYVwBQIYgdjSVSX7EfFXKXP5M+HYSraO9TtsguyqoDzUGjAXEjfDJwP05l:gKNegJSwrYmHNrrzRqo/XjAXE7WggG
TLSH
T10F042331FEC7916D14EDD62BB2C1E61CE41078DD2E88A69B18D658EEB3585FCAC00357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 138KB
SHA256 38d917076c7eb7dd3e10f1a7fec9385a452c3506d6a182c0a923e9b43862ab92
MD5 c8e67ddecb711b813dd6ee96a041ee20
SHA1 8e5c54552bd89eee7ef7d2fdbdc30d6543f0b21e
SHA512 f716cdeaf411d3ccadd05774c8c2690b6d61d70d56e76073f52e7d71b47bd8684f82c5c8ebd5284e713700353c2ca1bcf4393ecc831d79fd174b0264b231ca7a
SSDEEP 3072:Xdw3TX9y09vV8KsGU71gzaVeLH+Ipv4b3RNDtWPUlNl+JxN:twp3vVRsGU7GseqIpoRNwjF
TLSH
T1A9D312B219E53BB6E020DE99718FB10DECD86BE6E0907CE755C8D6478808756C58BB3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 a972b86a6389f631c486a0e36abd25d0995e85ba9be35a3e081c179eb4eda3d6
MD5 0b9f699dba00883e95246655d2de1eb9
SHA1 dde51b2a812b95097356c4f4efa2f7a16fb70f28
SHA512 6d4e970c6c92d96bfe9185d8d968901a6e0f43952c88bd972a126f2869501c7ca2e9b3ca14bedeb021e2e54a03ce829ad1058fb620eeb5f64123ecb950f5ae15
SSDEEP 96:KXFc0K2gVos7aQ+0HccQHqF/AcA4z8wCUez+V+wC8d3+7nlCFHpd:CwDh7aQ+dK6Zc4z+V+wC8dOEt
TLSH
T18FD1CB78439E9619DF64303F52D15E4E37349EBD0903BFE7A956F8772B12385A823409
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a5267.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a5267.TMP
Size 2KB
SHA256 e004fff7b3052410e6b4af9aea5b2285ef778c1b17ac0af942aaad1b053a46c7
MD5 f85c66ec32fc5398cff1dd3b9f9cfa9e
SHA1 c279bd47ef56bc0965ed08aacb88cee947662b25
SHA512 71c15497261d533357bebc76bb09e2cb1254088d1d6efcf721aec1e2be1b5b475aaa1d67760b49df0bbfae78674b9dac45c331fb1d66d5a4bcd04cb712712eef
TLSH
T17351B5BC42AF0159DB58493353E0619B3B38EAFD0A673EFF5DAAC8B46B16B15DE04014
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_culinarydepot.wetransfer.com_0.indexeddb.leveldb\000003.log
Size 256KB
SHA256 8958cf58313c6267a4feb2d2c20446be0be71792ba8fa740c72b58383e64e237
MD5 a3fd048712dc0bbf4e82f093e175abb3
SHA1 e0484315e4bcbee40423e5044975a871da668d42
SHA512 f88ca2872aa74fa89c115b5383f6c8c7e80e483bbdba5ef1547ab7779e514ff856d930775e5fa6ab0ada7dd86d2095f96cf43a2fd6d4a00de53dea03e4c3483a
SSDEEP 3072:IqpZMeXwMAGVa/zCNDlu5WgMfRBPCPVxuNce9gsXo639RmUvdAAGAarg+7Axqwbx:94b+yF
TLSH
T1D1442B7FD8D8C837DAB28637D1E52B4AC6F9AE023D444C4FE0CA3B454873B552C98A56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_culinarydepot.wetransfer.com_0.indexeddb.leveldb\LOG
Size 377B
SHA256 3acfacbe558af8047d24afe06a982b53eb2d63294f8c59de8aebdcd007093be0
MD5 a1c3284ec02c792191cc05ac61300dab
SHA1 592fd292af9bc9101bd2c21c002691cec672cbdc
SHA512 936eee6efd3b8185bd51868cfc61707d61ad810e1c620ef575f28da3603ae85cb8c1ee31e44e82f4095fd55d8b202265cc639a0813c6968d6df892f2f0050e97
TLSH
T10CE02B2CC8CD816F621411E25174FF0DE5EFEB0EA7CC7D895F15DC55B545088909E352
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_culinarydepot.wetransfer.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 b5539eb92792986b5a733a56a6e80a1ccd6dc38ce333ff9b702e1e9959cd3410
MD5 b374a63e37b27e1cc021310e9fd75e72
SHA1 0124a470c1431861bd5c46a3c99f15714a3aa75e
SHA512 7f6ed548a1fea3933ce8d18ab3947e96b00628d40291b49a7012de79ef60faadfbdb5d799b17e5d660595928262a9c4e63e0dfced85822e5f0d64f729c4300b3
SSDEEP 192:DdgUrCDJFeqlUxVq5IKqaimdjhnr/3lPB9weRy4QHD3ZlJ1Rk4Xf4Wxxal/xLyf+:DdgUrCVFesUzmIKqaimd5r/3lPB9weYY
TLSH
T1A1227EF3C3D4872DC80556F06B146E1ACE5E0528A26D3C2B89E9EE5BF3D24B7D18164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fb89e2dd473ac0039f9b16a147f33a8e19acbd6bedb91309bf2edb40c3e95f91
MD5 ae074fda674c6ef7775b058d39fbb17c
SHA1 dffa193b849c0e0afeb0beb5a5e92721af3b9f36
SHA512 4abd31126e28edf3d104cd0515d8621bef66d52aa5045f20c9953a3bfddb0fd0376eca1f6edf74938dfa67ea979d9f86e79db02da7566a690ba40adf72e7e8f6
SSDEEP 192:sxRWRM+bH/fsPs5yYhrzoA8pQ9V/g6+WNKFB7QN1t/Y2LcKGEIgDOJ:sxRWJH/fsPs5bKi/5EWV/u2u
TLSH
T12142D8469D28A97B4CD7D21DFA65BF13D2F95133A4D01E49A6FC8A1C04EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 eb5ebbada5d2b7fa610700b0f96466053486717db7983c18efeb2e80ceea355d
MD5 5c636afed08caf63389c1b09b0ba1b4e
SHA1 88e0d6a4647b8cee1f0b6c053a04d2a27550087a
SHA512 c3f301243529691c4e47e21c5ac4e1149c65f19b561aef8318f7cbb81f664229d87a91a321625d41d47b21a1d5a46f5616d8f09cffe3fc6ed06c96eaffa87e0a
SSDEEP 192:sxRBRM+bH/fsPsgyYhrzoA8pQ9V/g6+WNKFC1t/Y2JcKGEIgIJ:sxRBJH/fsPsgbKi/5ES/E2s
TLSH
T1A042C8469D28A97B4CD7D21DFA65BF13D2F95033A4D02E49A6FC8A1C04EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a351a7ea8e4c3566a8d3a0e45c32173c3ffaf14d2a294383015b55ce80e3fee2
MD5 28bb75fba668d3a4e931320167cb3fde
SHA1 7a2a83688c0b3d6e7e1882949e332f0a93008f26
SHA512 46f67e83c7b135020912d1a190df866379c9bff8aab4ff8af64ade0fecb8a43df4da12c9efd35c6255a76a40988865e47a225faf1258fe8e386ed82ed3c4e429
SSDEEP 192:sxRWRM+OH/fsPsUyYh9zoA8pQ9J/g6+WNKFB7QN1t/Y2sUcKGEIgDUJ:sxRWMH/fsPsUbwG/5EWV/+x2s
TLSH
T18142D8469928A97B5CD7D21DFA65BF13D2F95133A4D01E49A7FC8A1C04EB6CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 beba7368883d88030ce7ef831dcd7fe4429e3cf614882057f29edfc7d71ec298
MD5 69172f51f24720ce6ac822e5ffc68483
SHA1 2bf1a3b2a6c0ba94f98be37f5f1857b1ceff196c
SHA512 2acea80aa1d12939c8528e9e6ef80f9b70e54b9d3e59f5a09e1aa0b218f1c000f879a2fde663f790b9d02db945e55d10d235655ee62cc6d432b9b2c5a3fc8d0b
SSDEEP 384:LbnaaCTfCtgp/FfvDKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVPH9NvRWQroHrS:L7aaCDWgptfvD8F1+UoAYDCx9Tuqh0VE
TLSH
T16DB2EA2F644CCB7E8FD00A9DAC196F977E9802C796588D4047FE994C02C77EA911E4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba23d8ecda68de77_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0
Size 65KB
SHA256 e0e31e3e2b6b430c6de4272f79d489f3729830d47388e800b0a91f529efda0c7
MD5 4d2d3b374821db8192f8607ae666e7fc
SHA1 7ddc9cc76707367a7ed64a7580bf5a6ca5b3a332
SHA512 39547d6c38d443d6799b35c45f5998e8a28c0426869b4ccbf0cb072b27ccf9c948a1f7ab5373cb6d76b1562134e1278903a5baf2ade1ef1c869c5e5e642265ed
SSDEEP 1536:kwaGJUKEXr6EYQ85iwMAJXHWgH5sM2Vhl/gkWPnbjNjHWJvknbrNTa:g+XHWgZVNj3brE
TLSH
T141633CE7341B10A20FD776BFE856E9E5BC33515D6CCC8958FB30492D0384A7C166B998
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 60f118422e5c7e91abe97b54ea82c89328ea5e8e6b5e7aea394c8172e0b95988
MD5 06303c3355862863546d2704c39572b1
SHA1 42eb5b555179a5238c9bbe843eaf5c92d75a8eed
SHA512 84d157c4e3e63943bd73051ed9343d4ae3fe022a406b626d0b0978f3ddb4f52a60801de199df9142d4611de2160912505462c0fdcd398289467f764fe4e6d652
TLSH
T134B022000C0002C3E20823FCC0C80EC8333C2C8A0F032A2382FA00B08822328802328A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e2f4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59e2f4.TMP
Size 48B
SHA256 b1b898c622965aaa7a3712fd3a8723b631cd9a61ccbb82cfea1d9e6bddaa29c3
MD5 92862a0e47b3c3fcef4e187bfaf9747c
SHA1 5bb57f5301d8727341fe3d569791fa36d42ec89c
SHA512 5172f9d155a81e6a1d0de59f03053b8ef95c8fbc107b401b61c8d179c69ab846f32702c830b638ea9e2dd4ef824feea305ae2bdd936b357c2ecb72037df97802
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a834b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a834b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 37f9c261af39472a0f5a71e5af1c4218b21069b30e464e290fc4dacdbe61a39b
MD5 b7da77e9482747e596a741cdb8f80a2f
SHA1 44ae790beb86165de8ff200bf97d591111d527d4
SHA512 cad8ee3dce9bac5200f1371442dc30cfc80b3e973e4a93fd5339f9041bc15ee55b0c9656944ca96279b436305e762a4b6335a271e416512dc1c0e1320f15eddc
SSDEEP 768:u/UxvxjgC+k3jIcSgm1OgJPGDmGA5b65Q92RQMPbEBd:jZj3+k3jhyP+AF65dQvBd
TLSH
T12303CF32ECA0ADB39CB5A5C0364AB356FFF4862391C5569049ED6F0D05CB6DD430A91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 07c7c48c0c8ce2061d0e811db03d8adf5c6f6691137cec105230dc333c31d002
MD5 662dee238c78a4eaaf31dd32de5c0b7d
SHA1 b08072a94afdf0ec61e309c0198e87424bbc21b4
SHA512 0f479d9706f587271c508a60f4c9be14415955304822fc5a1f13f69ed0ba8d132011444f608fa128bfc55f368ccc4a48e3f81f530bdcf80a94a410c0c010c5d4
SSDEEP 768:B9376cSgm1OgJP2DmGA5b65Q92RQMPbE6184p3Xm:B937zyPuAF65dQvZqXm
TLSH
T13BF2BF71ECA0DDF36CB852C13956B315AFF8C223E5C8869099E96F0D058769A431ED1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e126cf9f3fe60e6d1842a5c5fcd63ffc947eee086b2ceba845c833515907a9de
MD5 80885e961f4ae3f9adf5fb6761a07cef
SHA1 a8c2f9c20ec85e9171ef86e2cee52f9f3eb6e860
SHA512 2e69f874de2e20826f68a03ef8ab5601c01203ff91f5941a0fb3fea4319b1c3062fa7fb0d7013b06f8098656b9e025e02e1ecdc54b63cade930119dc4c74b1ef
SSDEEP 768:G93j6cSgm1OgJP2DmGA5b65Q92RQMPbE6184p3Xm:G93jzyPuAF65dQvZqXm
TLSH
T18CF2BF71ECA0DEF76CB952C13956B305AFF8C223E5C8868099E96F0D058769A431ED1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 26c6f16f55dc1b490686b83e0ae0c4a519ce0f25d5b5b4b4830be2fca3fd4070
MD5 43d233bcee92d52577272eca6421d316
SHA1 2ef79c903828c11c971633f13f3576070a49fdd1
SHA512 8b54c599a5b51a2170616fcbaac91e87344787df8a5bb77eef966dc7f6a1091247098ff1f6f3f4f99e1d7b9d1baae5be098303c4fa7a490597720fa004836878
SSDEEP 768:U/UxvxjgC+B3q8dyvgm1OQtDmGA5b65Q92RQMPbcNFj0O:BZj3+B3q+43AF65dQxNFQO
TLSH
T11E03C036EC90AEB3DCF95280364BA35AAFF88563D1C556A049F96F1D06C768C430B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c28ba698aab8cacb11d4b73f289b2357cfe1c6284c624d83550d15933888e46f
MD5 8f80f2e0d0f0bbe27f4f3e236a2a7fa7
SHA1 29e1088628a139d2e32ba44f3fd44a9ea09293da
SHA512 7dc8c69cf85706498e1d74fdef3a94e78158fc6842f6ec63bb9f63b1b5dccd2152184ce7caabffcbd7f747d926638e451b94d1e6b9050ece72286f76da64bb94
SSDEEP 768:UFQU3gwgW1tcSgm1OgJHDmGA5b65Q92RQMPbE6184p3Xm:3U351ayBAF65dQvZqXm
TLSH
T1CE03BF72DC90DEF7ACBD97C17A5A7205AFF48263D5C89290A6E96F0D01875DA030EC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15ace14f-1066-4c16-b7ed-9a9ef1fd6b00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\15ace14f-1066-4c16-b7ed-9a9ef1fd6b00.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads