hxxps://us-west-2[.]protection[.]sophos[.]com/?d=truist[.]com&u=aHR0cHM6Ly9uYVpc3QuY29tL215aG9tZWxvYW4=&i=NjY1YTkwYzdiY2M1NDAxN TgwMjk2Mjhh&t=SUpkYVVaZ0llYk4wUkNxTVlvL1RvZmxnYml1NzJSczVSVCt3OHlqT0Viaz0=&h=123b797993fd4fa8bb14ff9d3500152b&s=AVN PUEhUT0NFTkNSWVBUSVZE58dFCrXS6udJOPusW6LuFymAO9Z4cqDMRf5hGnhePwmZaAA7Sy50hTUL9zgNVVk

Analysis

user interaction
yes
max time kernel
54s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://us-west-2.protection.sophos.com/?d=truist.com&u=aHR0cHM6Ly9uYVpc3QuY29tL215aG9tZWxvYW4=&i=NjY1YTkwYzdiY2M1NDAxN TgwMjk2Mjhh&t=SUpkYVVaZ0llYk4wUkNxTVlvL1RvZmxnYml1NzJSczVSVCt3OHlqT0Viaz0=&h=123b797993fd4fa8bb14ff9d3500152b&s=AVN PUEhUT0NFTkNSWVBUSVZE58dFCrXS6udJOPusW6LuFymAO9Z4cqDMRf5hGnhePwmZaAA7Sy50hTUL9zgNVVk
Sample260709-txbleadv4k

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2220	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280879581065479"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{F03FE0D0-A88B-4D09-AB6F-05A84460E627}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 4220	3264	msedge.exe	87
PID 3264 wrote to memory of 2220	3264	msedge.exe	89
PID 3264 wrote to memory of 1060	3264	msedge.exe	91
PID 3264 wrote to memory of 1060	3264	msedge.exe	91
PID 3264 wrote to memory of 2252	3264	msedge.exe	90
PID 3264 wrote to memory of 2252	3264	msedge.exe	90
PID 3264 wrote to memory of 2252	3264	msedge.exe	90
PID 3264 wrote to memory of 2988	3264	msedge.exe	93
PID 3264 wrote to memory of 2988	3264	msedge.exe	93
PID 3264 wrote to memory of 2988	3264	msedge.exe	93
PID 3264 wrote to memory of 3256	3264	msedge.exe	92
PID 3264 wrote to memory of 3256	3264	msedge.exe	92
PID 3264 wrote to memory of 3256	3264	msedge.exe	92
PID 3264 wrote to memory of 2264	3264	msedge.exe	94
PID 3264 wrote to memory of 2264	3264	msedge.exe	94
PID 3264 wrote to memory of 2264	3264	msedge.exe	94
PID 3264 wrote to memory of 1952	3264	msedge.exe	95
PID 3264 wrote to memory of 1952	3264	msedge.exe	95
PID 3264 wrote to memory of 1952	3264	msedge.exe	95
PID 3264 wrote to memory of 2836	3264	msedge.exe	99
PID 3264 wrote to memory of 2836	3264	msedge.exe	99
PID 3264 wrote to memory of 1096	3264	msedge.exe	100
PID 3264 wrote to memory of 1096	3264	msedge.exe	100
PID 3264 wrote to memory of 2348	3264	msedge.exe	102
PID 3264 wrote to memory of 4248	3264	msedge.exe	106
PID 3264 wrote to memory of 4060	3264	msedge.exe	107
PID 3264 wrote to memory of 4556	3264	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://us-west-2.protection.sophos.com/?d=truist.com&u=aHR0cHM6Ly9uYVpc3QuY29tL215aG9tZWxvYW4=&i=NjY1YTkwYzdiY2M1NDAxN TgwMjk2Mjhh&t=SUpkYVVaZ0llYk4wUkNxTVlvL1RvZmxnYml1NzJSczVSVCt3OHlqT0Viaz0=&h=123b797993fd4fa8bb14ff9d3500152b&s=AVN PUEhUT0NFTkNSWVBUSVZE58dFCrXS6udJOPusW6LuFymAO9Z4cqDMRf5hGnhePwmZaAA7Sy50hTUL9zgNVVk
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x244,0x248,0x24c,0x240,0x26c,0x7ffd22cec188,0x7ffd22cec194,0x7ffd22cec1a0
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,9153439080508355560,15943030883718646492,524288 --field-trial-handle=2528,i,5586691594007585401,52932036086338079,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,5595204063245775287,8833578130562531744,262144 --field-trial-handle=2528,i,5586691594007585401,52932036086338079,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:2
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,10221297519350379760,13575548184931205163,524288 --field-trial-handle=2528,i,5586691594007585401,52932036086338079,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:8
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,2340867332904698759,7326341508227565253,2097152 --field-trial-handle=2528,i,5586691594007585401,52932036086338079,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,5813347464775391515,8923021192261072317,2097152 --field-trial-handle=2528,i,5586691594007585401,52932036086338079,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,12901061683770260933,10459261867283971254,2097152 --field-trial-handle=2528,i,5586691594007585401,52932036086338079,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,6610574123061230333,9484564209723933636,2097152 --field-trial-handle=2528,i,5586691594007585401,52932036086338079,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,14459611994974685883,11824154929515886715,524288 --field-trial-handle=2528,i,5586691594007585401,52932036086338079,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,16595493036177607532,4214280119056407219,524288 --field-trial-handle=2528,i,5586691594007585401,52932036086338079,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,6152111527384625869,7912246089970731500,524288 --field-trial-handle=2528,i,5586691594007585401,52932036086338079,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,6152111527384625869,7912246089970731500,524288 --field-trial-handle=2528,i,5586691594007585401,52932036086338079,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,13155094439782748370,429888012521281570,524288 --field-trial-handle=2528,i,5586691594007585401,52932036086338079,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,3476985294863419509,9494846488279367215,524288 --field-trial-handle=2528,i,5586691594007585401,52932036086338079,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,4679307930303685982,9037496791600066305,524288 --field-trial-handle=2528,i,5586691594007585401,52932036086338079,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:4556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 159cc3818fc280e443a80fc6f44058a8c0aef54f78c36717f83dd2be009b203f
MD5 11fc96a805b64179fa1c2bec3da015e4
SHA1 d5355c312d0c8d94932af287c4645ecf26a6c084
SHA512 42d8eee3403dadb9e3e9e40386ba3c5f29df9069b0712d687d99f4de5e526ef73bbabe85693f7355f008ba7a6ac4146a8df2cd1b714e3c73f006d4ba246c66f6
TLSH
T1D1613BF008C276A0EFDC0E3090D206957EF784EAFBB37E8910A499706E15761022B23F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 aab773081924b7e2219c88d1863b450179a8cfd6a05e89639363d427b8d721f7
MD5 ff17937c81e3aa350c373cca1fe9d25b
SHA1 45edf5890f4e31c2698ec3a1896ed81c79032026
SHA512 9c8b0dc5c6278d76e81b180fd348c6afd0fd60d4a7e48888710ab5fa21a6d0453c38b958e1c9691a7ae3d8d8aedca5795df98cd7b86d348277edff7bb4debb32
SSDEEP 192:sxZVRwyM/jK1Ml8Mkv/ffsJEBLrIdpY8HW6+WNhND/YChv2a4IgrJ:sxZVOMv/ffsJy0pHbX/o/9
TLSH
T1F652E9126A346977CCDBD209FA55BF53D6F9457292901E44AAFCCA0C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 0e6ab8718982e400782dc5666db17fb35c85a2009051842a90694a718933e531
MD5 d072f251af18cc59418b43cef9669eec
SHA1 8e97a137067dfda406acadd413b0a3f11a88b5aa
SHA512 e025f945cb40b8fbf6cd14892e76f05a9caf75a7e2a1b0229bf6670e81b02a82f69936f138d2287ea43ee035df9053ea82001012e8397391fd2d7ab257c5fd3a
SSDEEP 768:yP8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKV1rol1:yP8bqn+WvSCt6u1jaCZLbWVOl1
TLSH
T139D20A3B280CCB7E4F845E5DEC266F962DD801CB6B988D4447FA894C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d5b0ae061f68471d16e507936064a5e6c1b3bc0c2a0e6e2ad85e72fde035433a
MD5 650b674f307affd392a99b4e09e4e84d
SHA1 492887ebb15f2b1583e8a4100d9e73a6fbe1d368
SHA512 1513ed13ee402c428dbce3ec42be154ee99b1564c6bff69fb6b83d6f13c4e1b5d195ae517212bc1cbb03211a528c102ac2c621cff8d8a352c3acb17689b71611
SSDEEP 48:KQJI5Ky8sjyhOIXKzacnyhjgXz1xFgRZSzI+bgKz1btgHrwsCNIhfhIhthphfhd3:KQJSKy8KyOIKzam64YKBWHRu/bpLP7z
TLSH
T1E691D116303A4292683E6588F3979A365F4235A33158E86F7FB804A61F67E124CFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 607650b6957c16b67f882220a95325c59f5a85148a3251be400a9eb450fee61b
MD5 8a9bee01ee4906296d6789f283b5ea70
SHA1 7817ac54ef6ca5880e918e3c18a93dadcb2ff82d
SHA512 5c0d178437b54774b238610e32ddbe81d949af1aa0cfe6326c79e193e1526842aa34382450c876940c726576cf39c305c4a962971b32401eb040fc23d47e3076
SSDEEP 384:vtNn/s3n9SfsN6+8RabrQEa+SdPId+2uzjOObjI9G6w7yb:vj+9U7Kjan2dluzj29MK
TLSH
T187929D326C385D734DD3A599F48B39179FF8916B878A2F84E6EC8F0C05DB6AC4306919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 1696ff9a962fb57535868477e0fe6fefd6c8bfaa6a2e3e2ced8980ff6627416f
MD5 8a8876313a05fca801a6e4bb5bcdbb4e
SHA1 154b5c6840e640126f7dee4a8074bb22e0519f27
SHA512 37777998a9bca9877d2900ac8f478066f22daefef92d1d2b65b4bfabcd3d1c456c6db827f3fe70290db903205b215447193475f03ab0e870cbd1f66c0af5cb36
SSDEEP 384:2tNn/s3n9SfsN6H8RabrQEa+SdPId+2uzjOObjI9G6w7yb:2j+9UGKjan2dluzj29MK
TLSH
T1A9929D326C385D734DD3A599F48B39179FF8916B878A2F84E6EC8F0C05DB6AC4306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 23aaa1df3eacfdeb61603ae21dd35a9d56c31c23b403991752007bd93043a5e4
MD5 eef384cae7324b1125bb1efabb7e8e9f
SHA1 a429e853abfdd47e34de999e33ce6e73fc4dfee1
SHA512 b38e945fb38960b89d61b06af45872351aa8e8523a167abc5cb04775cc3de6351516c361f4aed116412115047f0ca16d7ec7ffac3758cc1a359c40afa94d037c
SSDEEP 192:vONGV6Db6QmiUyfHHBa+jx+FdCYHojRgzripU6:vONY6uiHBa+SdPIaz+pU6
TLSH
T17102E93568386CB79AF36E49F8877B239FD4106BDA962B45DAEC5F0C00D765C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4790edfa797e749dd7a0656480daaae92d61e0b191e2dd0c77bb1b25499e7398
MD5 9918cab4954c091033d90cc56e3737d2
SHA1 89058a9caf9eb4b0d7246760a280b254c97d25b3
SHA512 30c65702708b24a67f7de19c8c65cf7ed51816b073de7756beaeb113e0418802dddae8e544c2ba88ed39eee0dcd78e3d2226076bfb5d87370002fefe936f2277
SSDEEP 192:LONz6DbkQmiUyYHQBa+jx+FdCYHodX+2NNzzJqmU6:LONz6s7QBa+SdPId+2jzjU6
TLSH
T1931219366838AC7B5ED3A945F48735139EE49127DE8A3B91E6EC4F0C00EB65C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9c384bd356e7779033f202cdba64a45b8b5300f563d978584711d26b501f84c2
MD5 5b7b11dd91b13e6a165600ff37992b99
SHA1 bdf55d657acbca47725e31ea7130c838fa86cf02
SHA512 255b42f3a3967d1d0b3c6b80af4de77e2ef3d05131ca0007f229831433235546a352a92083a8e1618f0149803568587297cbd0c80fcd27e3dfc09e795747b27f
TLSH
T13B41F448B6EA1118B3B36E5AABF6A86E447F7C672F06D45E00110D4F0B23B41CC61B33
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads