hxxps://google[.]com/share[.]google?q=WYpas8HlxpjMM8oqh

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://google.com/share.google?q=WYpas8HlxpjMM8oqh
Sample260930-pe75faeg82

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3504	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{D697E386-7118-474E-966C-79B36D8A1A7E}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{A9039D14-D6A5-445D-8BB9-99B01F55166A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5212	msedge.exe
5212	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 3720	3192	msedge.exe	86
PID 3192 wrote to memory of 3504	3192	msedge.exe	87
PID 3192 wrote to memory of 1716	3192	msedge.exe	88
PID 3192 wrote to memory of 1716	3192	msedge.exe	88
PID 3192 wrote to memory of 1716	3192	msedge.exe	88
PID 3192 wrote to memory of 4868	3192	msedge.exe	89
PID 3192 wrote to memory of 4868	3192	msedge.exe	89
PID 3192 wrote to memory of 4956	3192	msedge.exe	90
PID 3192 wrote to memory of 4956	3192	msedge.exe	90
PID 3192 wrote to memory of 4956	3192	msedge.exe	90
PID 3192 wrote to memory of 792	3192	msedge.exe	91
PID 3192 wrote to memory of 792	3192	msedge.exe	91
PID 3192 wrote to memory of 792	3192	msedge.exe	91
PID 3192 wrote to memory of 2008	3192	msedge.exe	92
PID 3192 wrote to memory of 1568	3192	msedge.exe	93
PID 3192 wrote to memory of 2008	3192	msedge.exe	92
PID 3192 wrote to memory of 2008	3192	msedge.exe	92
PID 3192 wrote to memory of 1568	3192	msedge.exe	93
PID 3192 wrote to memory of 1568	3192	msedge.exe	93
PID 3192 wrote to memory of 3488	3192	msedge.exe	100
PID 3192 wrote to memory of 2256	3192	msedge.exe	101
PID 3192 wrote to memory of 3488	3192	msedge.exe	100
PID 3192 wrote to memory of 2256	3192	msedge.exe	101
PID 3192 wrote to memory of 2640	3192	msedge.exe	102
PID 3192 wrote to memory of 2640	3192	msedge.exe	102
PID 3192 wrote to memory of 2640	3192	msedge.exe	102
PID 3192 wrote to memory of 2452	3192	msedge.exe	106
PID 3192 wrote to memory of 6556	3192	msedge.exe	111
PID 3192 wrote to memory of 6564	3192	msedge.exe	112
PID 3192 wrote to memory of 6564	3192	msedge.exe	112
PID 3192 wrote to memory of 5228	3192	msedge.exe	114
PID 3192 wrote to memory of 5228	3192	msedge.exe	114
PID 3192 wrote to memory of 5228	3192	msedge.exe	114
PID 3192 wrote to memory of 5804	3192	msedge.exe	121
PID 3192 wrote to memory of 5812	3192	msedge.exe	122
PID 3192 wrote to memory of 5820	3192	msedge.exe	123
PID 3192 wrote to memory of 6404	3192	msedge.exe	126
PID 3192 wrote to memory of 6404	3192	msedge.exe	126
PID 3192 wrote to memory of 3544	3192	msedge.exe	129
PID 3192 wrote to memory of 3544	3192	msedge.exe	129
PID 3192 wrote to memory of 5212	3192	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://google.com/share.google?q=WYpas8HlxpjMM8oqh
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x288,0x7ffc0052c188,0x7ffc0052c194,0x7ffc0052c1a0
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,14951898934138623088,15807318336328755320,524288 --field-trial-handle=2300,i,1369768270149988323,18322039340261045019,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,6993124784869519505,2336242061691546270,262144 --field-trial-handle=2300,i,1369768270149988323,18322039340261045019,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,1954742131277877428,16786319463385837552,524288 --field-trial-handle=2300,i,1369768270149988323,18322039340261045019,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,16744536644715789443,8108450725214236420,2097152 --field-trial-handle=2300,i,1369768270149988323,18322039340261045019,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,12533427808685747924,17163564548308142849,2097152 --field-trial-handle=2300,i,1369768270149988323,18322039340261045019,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,3117470651456266296,15804904674056566615,2097152 --field-trial-handle=2300,i,1369768270149988323,18322039340261045019,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,11389867539222599755,5553819138897646658,2097152 --field-trial-handle=2300,i,1369768270149988323,18322039340261045019,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,9841429953177413264,8142232537069001331,524288 --field-trial-handle=2300,i,1369768270149988323,18322039340261045019,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,4246334305549045549,7977531914524071345,524288 --field-trial-handle=2300,i,1369768270149988323,18322039340261045019,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5724,i,15995398744464597499,10867614250099460549,2097152 --field-trial-handle=2300,i,1369768270149988323,18322039340261045019,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,3126817633091006331,2310126354854011934,524288 --field-trial-handle=2300,i,1369768270149988323,18322039340261045019,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,3126817633091006331,2310126354854011934,524288 --field-trial-handle=2300,i,1369768270149988323,18322039340261045019,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,13570792421177697135,10219763083139114652,524288 --field-trial-handle=2300,i,1369768270149988323,18322039340261045019,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  - Modifies registry class
  PID:6556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,375471690406395792,1376354180235074717,524288 --field-trial-handle=2300,i,1369768270149988323,18322039340261045019,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:6564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6560,i,17216200886105643706,14568374426487092291,2097152 --field-trial-handle=2300,i,1369768270149988323,18322039340261045019,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,6360991258009600280,14828924636854608451,524288 --field-trial-handle=2300,i,1369768270149988323,18322039340261045019,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,10986778809268611851,16497870269887041331,524288 --field-trial-handle=2300,i,1369768270149988323,18322039340261045019,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,11940317085694744324,8532759643796507029,524288 --field-trial-handle=2300,i,1369768270149988323,18322039340261045019,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,1667474810577857834,9225249818460311671,524288 --field-trial-handle=2300,i,1369768270149988323,18322039340261045019,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:8
  2⤵
  PID:6404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,1878719352399774001,5181445947769581579,524288 --field-trial-handle=2300,i,1369768270149988323,18322039340261045019,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:8
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6172,i,18175318077264753788,10825290960326688528,262144 --field-trial-handle=2300,i,1369768270149988323,18322039340261045019,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5212

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 15KB
SHA256 6178e532cc77b11449d6bd1d30393afd274d099ae3d65748a8c54a1b514d443a
MD5 6510c7425af1b3475dabac41d712aeef
SHA1 8fb8ba39449451d9c3ecc74e7cfd38bf140e2234
SHA512 b14d423e21d99ccc9cbce64b8860be435b7976d7dfa73df853b5c26bb51fdd55ed533bccd9763af5fd07378c9069034961a50a3e551c8cb657e7992da55b2b51
SSDEEP 192:rbrW4Ft5sQMBfduO+6isgL7W1UwPNW+8oclMAGLrjFK21/94WQ:lNsNlutu+jMAGLrRKEaWQ
TLSH
T10362F300A5943759F798D93753FA27BAB23B2281D0C36F006D9AE5FABCB5383C14526C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 c41189800351380fef3292a3aec98375e03683e5d6888ac28c5cbc80c46aa166
MD5 b8a4b0cb33b73ece6ef33451bf6c2e87
SHA1 e6ddcd41eaa51cf0b62232c721576deda12d959e
SHA512 9a452016c64a1b1f9652c540bf8d9831cafbb94be0a458166ed6e797269174437a40087560a934183b48d8c40f711d27861e72e259d50107d3480b6ec86c7b51
SSDEEP 96:DCNxO2VYxl8czINc6l+eufvGqzRxl4BaVHDfvwQ:D4k2VYxl8csNPz4GqzRxlcaVHDfvT
TLSH
T144A1EDF7C3E4826DCD4196F06A156E1BCE6E061643283C5A85D8BF57A3F2431E281A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0ec35d8b1ca61e744ef40c67e361e7fcef4c42aa926b33eb39b92fa408c5ff64
MD5 1daca6134a29d7720ee81b825b38e3d7
SHA1 43a784064b2fb5a17c15b48d9feda5f06d737b62
SHA512 26f3e66f2887e6a38a7092d8b94e1814fbcb91a96b9c7461e912ab838f3af24ee40f3844618a00e1a723a2488baf178538a0246c72a95a447e0375feceb96b4d
SSDEEP 192:sxZvRtWs/fbsKvmIdp4XSHW6+WNjRV/YRPYbrIgrJ:sxZvqs/fbsqHDHbz/mE9
TLSH
T14622C7926E74A97B4CC7D219BA29BF53E6F90032A1951E48AAFCC51C04E77DD230784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8fc64118a00b6e19da010db4a3300b59540fa4d4e81fd8b54d68e3998fe4a9d4
MD5 1f7901c2f53c32da343f5bd06dd0816d
SHA1 65f9599e7dddb2f3923d216db96ae00a78ffa08d
SHA512 7664e07bd85493879b02ef0d6fbcc73de8a6d1ca7d40da1991fb3f3f90fa4f6f2cb37d5f8e3d4301f8243ba4ba04f5d912c0227cc001cf65b0e6d8b7f35fb109
SSDEEP 192:sxZvRtWs/fbsKJmIdpuXSHW6+WNjRV/YRPAbrIg5jJ:sxZvqs/fbskHpHbz/ms7
TLSH
T19932E8926E78697B8CC7D209BA19BF53E6F9403291951E48AAFCC61C04E77DD230784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6ebfde5955f8987dc542b5163567d4eaca86296e195fef705c09dfc86b8cda06
MD5 eb17b749e5503f54ba87cad9725bd1b8
SHA1 07ade7637152f43435ff70b9598379d152775933
SHA512 c606314dfa93ee38668364ae51dec0112f436dd53c67bbd93cc21634567310e4f32c0ea77b30e85b8adec8e59f2d5139ed35c1fd3069b5bdb330a61faeef040f
SSDEEP 192:sxZvRtWs/fbsKJmIdp4XSHW6+WNjRV/YRPPbrIg5jJ:sxZvqs/fbskHDHbz/mv7
TLSH
T12E32D8926E74697B8CC7D209BA15BF53E6F94032A1961E48AAFCC61C04E77DD230784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 eaf4ec08f3abf502005d05d9d7399695dcc85da66e044837622b9f2d0b1f5aee
MD5 79aa569bef1a25819b426374bdd16558
SHA1 34f17a2b723ab00bfabd2201aff6a4489f33549d
SHA512 213fb27ec3110f620ff46ce5e12b65e9f0de965d1fcbb20efc9a4b1da5441242bdfa0cfb1f4c50d6053274686ba650087be5dc18093816611538b2a8940f63d8
SSDEEP 192:sxZvRtWs/fbsKvmIdp4XSHW6+WNjRV/YRPYbrIg55J:sxZvqs/fbsqHDHbz/mEV
TLSH
T17E22C8926E74A97B4CC7D219BA15BF53E6F90032A1951E48AAFCC61C04E77DD230784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c286ccf0b1ab9c6c9efdc20a5ce3e3a402a54637a8d0ddf796d174955770f2fb
MD5 d76f619a9a0e0aad8947ddd40ef8180d
SHA1 2ba02d874e3d86495c3663fddba3d86b186f3f6a
SHA512 b5f7d18c3d425adafd2215f9dbd72541fe6261e46f4d952acb089ad167f9dec6bca80407b7c85933223578fd2b813aaab1b4e92363eeccb2f92140294d9bf64b
SSDEEP 768:BdK9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3yrog+9o:BdK9uzYWvcQWsu1ja0HL7Q3pg+9o
TLSH
T12AC20A3F640DCB7E4FC01A9DDC5A6F973E9802D7A6688D4047FA984C02C77EA52264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 dedda05be61b8203f7534041051cc5ee010a57a6269aed43bdbd5e3dc42b77a4
MD5 b147ebba59b1d8b9d59377fa43cad8ba
SHA1 da62a1f61d1934f3b2036fe8140528bf9059e113
SHA512 2eb13f8dabc51a8622e7ce564dc6b263c693da74ccedf3ca28160f693db7ab5b37bdf11ce13761124f657455a3f664c5bbc601eb312d07e1c884964476863089
SSDEEP 96:K0mgeNiOw8YEI83viWEK6hi4EmuOXwuZPJoPTBDvjI/OSibjK66i9jm5xmHWzyKr:zlXqY
TLSH
T10591A995707B02443CBD694884F5962F528232B37058FA6B7FBC04B59E6AE484FFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0ff8deb-e1d4-47dc-b428-5911e7701213.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e0ff8deb-e1d4-47dc-b428-5911e7701213.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 35b0b5e444aa619c0fbf5e5955fa8ef2a83aa1e2547862f10b188feac659dd04
MD5 adff8354f6bb32cf65ac206fa60cb30b
SHA1 5bfb51c45165b9e6b9f0bcaa08a82707eb2df625
SHA512 e98f60004f20b3b682eb0d0810a2131baed347d26e7c46362c390e7c308d2321a0c362c67266b0c758d8bb0005dec18041d4b6050cac255e9a0be8bf915f75f7
SSDEEP 384:MZcIhsN9owPvb4XOjTVi0OGCj7+20E8etgOIwZOy4ToR:ahBenFOxj7lf/XsZS
TLSH
T148827E725C785CB75CE7A244F58B36038FB84067D6CA6BD494EC5F1C01DB6A8130BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c2241f7ea937edab48da3647ab46e785796eca8833e84b5ff5c2134500babb58
MD5 99c3f4be1f47c3df584aebbbab0c5e0c
SHA1 c117c62891ed7a8f022ea27a86265c1302ad1cd9
SHA512 81009f1d6ca52d11556c49aed6441f0f05204d334e5d59e77b3128df399d6da99d5c34721b174b5b6f7d16bdb93cbfedacff02731323bf86168008f38977d249
SSDEEP 384:NiFiZcI/zsNH8TUNTUlIlJwPvbTXOjTVi0OGCj7+20+8etgOIwZOy4ToR:EFQ7CwgsenFOxj7lf/XsZS
TLSH
T19AC219F248D74876D8AE9743A77E2D038EBCC053F586A690B3985A1CCD961BFC30AC55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 75b75e6f2d86901f30abdf82cb0112dfeeab3321ebffa91b0cb37306394abf36
MD5 3a560e6c23027b3fd0a7352999c81fd3
SHA1 5c4d09994fe09b1b5fb2f3042a4a0a5dadffdd91
SHA512 0bf655edcb4d926d7ef4bdb09cbc88c128bc936cda29e97c9860cfd45669bbebd325a9e17a70b689f82c030b8136fb03c43fad08f2c402909393488f5791ccd3
SSDEEP 192:SONo6ymQmiUy4FlOCTVg10OQmMCj7+2023UbqJT6U6:SONo65ZlOCTVi0OGCj7+20/8eU6
TLSH
T1D512197578686C775DA2A584F48B36538EA84267DA4A7F90D0DC1F1C02DF6AC230BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 087d49c697b7e0326cedf618b528e1c777551fc985108bf6128b2444fd11883f
MD5 ddd8ab3ad9facc67a050b895a96469d5
SHA1 73b23e622e0b5fbb282188ca5d96610df227ae5f
SHA512 4dc7e2ffa051db31168c9ff16f4fd91eae08eb83a372748200f17fa8b781c2a8ca85edf4c0fbb44552922882de656cb19f9a78f27732c3c743854f31ce109641
SSDEEP 384:jZcIhsN9JwPvb4XOjTVi0OGCj7+20E8etgOIwZOy4ToR:7hwenFOxj7lf/XsZS
TLSH
T1FF827E765C785CB75CE7A284F54B36038FB84067D6CA6BD494EC9F1C01DB6A8130BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 424dd5de559ebd2d3fb3b955c190775af0552da1e0360db9132567c46893baf5
MD5 661e78b7284544ed24e9c996074b30ae
SHA1 d6fc9b7cd3ecff4f8f58aca90dbc27528e4a680b
SHA512 18c3c8a4d65aa537104310d2ba679c7a29df49d1e54db5c8eeaf859ffb13f96a1a4c63a0623bacc8beb527cdfc6aa2e34987ee290e857f03a134d6374f89ce32
SSDEEP 192:SONY6ygpQmiUysFtOCTVg10OQm4zPS0VU6:SONY6lHLtOCTVi0O8fU6
TLSH
T10F02D734AC783CB78EB3AE45F58B27139FA8116BDA562B84D9E81E1C01D765C2307936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6bf343c-9983-48fe-ab50-0c9d061df33f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f6bf343c-9983-48fe-ab50-0c9d061df33f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 90de72ad3cec9194642fee1eb0712b5ced4ca974bbeb030dcf60e6072c174358
MD5 c2066c93b0cf1281e2a06ced412aeeb8
SHA1 a29c5e9284286a17d748e8f8374af3e7da0857bb
SHA512 5efd4b87cf1714d4ddd1937a7613fcee3df188abf94d70cff0bac141ce818fb07dd7081b276f9d9c52f68e446cd59a00f0a39325720d82f58622d9e5392e9e78
TLSH
T1E7411858B6EE1148B3B76E5AABF6A86D487BBD372E46D45D10110E4F0A23F40C871737
MD5 SHA1 SHA512 TLSH

Submit Download