hxxps://us-east-2[.]protection[.]sophos[.]com/?d=cloud[.]microsoft&u=aHR0cHM6Ly9mb3Jtcy5jbG91ZC5taWNyb3NvZnQvcGFnZXMvcmVzcG9uc2VwYWdlLmFzcHg_aWQ9RFFTSWtXZHNXMHl4RWphakJMWnRyUUFBQUFBQUFBQUFBQU5BQVFhb2FQeFVRa1pMV2xoRVR6QllWVWswV1VRNVZWaFhWMEZMTVRaVlJDNHUmcm91dGU9c2hvcnR1cmw=&i=NjkwZDQ5ZTFjNDQ0M2QzYTY5YjUyNzVi&t=aE1pQ1ByKzhkTXdLcXBUTzc3K3R4cHUyMEdqSEd4WVBBdVBWT0RXRG5Qcz0=&h=38c4df4267624cbcaaf9e0adbb56fdc7&s=AVNPUEhUT0NFTkNSWVBUSVbZ90i7TVFmrubF_gESPY1VlmKUMmjgpZkCGjW2NJ0O4w

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 15:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://us-east-2.protection.sophos.com/?d=cloud.microsoft&u=aHR0cHM6Ly9mb3Jtcy5jbG91ZC5taWNyb3NvZnQvcGFnZXMvcmVzcG9uc2VwYWdlLmFzcHg_aWQ9RFFTSWtXZHNXMHl4RWphakJMWnRyUUFBQUFBQUFBQUFBQU5BQVFhb2FQeFVRa1pMV2xoRVR6QllWVWswV1VRNVZWaFhWMEZMTVRaVlJDNHUmcm91dGU9c2hvcnR1cmw=&i=NjkwZDQ5ZTFjNDQ0M2QzYTY5YjUyNzVi&t=aE1pQ1ByKzhkTXdLcXBUTzc3K3R4cHUyMEdqSEd4WVBBdVBWT0RXRG5Qcz0=&h=38c4df4267624cbcaaf9e0adbb56fdc7&s=AVNPUEhUT0NFTkNSWVBUSVbZ90i7TVFmrubF_gESPY1VlmKUMmjgpZkCGjW2NJ0O4w
Sample260813-sh83pasflf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1524	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311073547795145"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{7DC1C297-9057-4E35-9567-C79F396ABFC3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
944	msedge.exe
944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 5972 wrote to memory of 3000	5972	msedge.exe	84
PID 5972 wrote to memory of 1524	5972	msedge.exe	85
PID 5972 wrote to memory of 4132	5972	msedge.exe	86
PID 5972 wrote to memory of 4132	5972	msedge.exe	86
PID 5972 wrote to memory of 4132	5972	msedge.exe	86
PID 5972 wrote to memory of 2448	5972	msedge.exe	87
PID 5972 wrote to memory of 2448	5972	msedge.exe	87
PID 5972 wrote to memory of 4120	5972	msedge.exe	88
PID 5972 wrote to memory of 5544	5972	msedge.exe	89
PID 5972 wrote to memory of 4120	5972	msedge.exe	88
PID 5972 wrote to memory of 4120	5972	msedge.exe	88
PID 5972 wrote to memory of 5544	5972	msedge.exe	89
PID 5972 wrote to memory of 5544	5972	msedge.exe	89
PID 5972 wrote to memory of 2140	5972	msedge.exe	94
PID 5972 wrote to memory of 2140	5972	msedge.exe	94
PID 5972 wrote to memory of 2140	5972	msedge.exe	94
PID 5972 wrote to memory of 3452	5972	msedge.exe	96
PID 5972 wrote to memory of 5316	5972	msedge.exe	97
PID 5972 wrote to memory of 3452	5972	msedge.exe	96
PID 5972 wrote to memory of 5316	5972	msedge.exe	97
PID 5972 wrote to memory of 2176	5972	msedge.exe	99
PID 5972 wrote to memory of 1408	5972	msedge.exe	105
PID 5972 wrote to memory of 740	5972	msedge.exe	106
PID 5972 wrote to memory of 2460	5972	msedge.exe	107
PID 5972 wrote to memory of 4484	5972	msedge.exe	108
PID 5972 wrote to memory of 4484	5972	msedge.exe	108
PID 5972 wrote to memory of 712	5972	msedge.exe	109
PID 5972 wrote to memory of 712	5972	msedge.exe	109
PID 5972 wrote to memory of 452	5972	msedge.exe	117
PID 5972 wrote to memory of 452	5972	msedge.exe	117
PID 5972 wrote to memory of 944	5972	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://us-east-2.protection.sophos.com/?d=cloud.microsoft&u=aHR0cHM6Ly9mb3Jtcy5jbG91ZC5taWNyb3NvZnQvcGFnZXMvcmVzcG9uc2VwYWdlLmFzcHg_aWQ9RFFTSWtXZHNXMHl4RWphakJMWnRyUUFBQUFBQUFBQUFBQU5BQVFhb2FQeFVRa1pMV2xoRVR6QllWVWswV1VRNVZWaFhWMEZMTVRaVlJDNHUmcm91dGU9c2hvcnR1cmw=&i=NjkwZDQ5ZTFjNDQ0M2QzYTY5YjUyNzVi&t=aE1pQ1ByKzhkTXdLcXBUTzc3K3R4cHUyMEdqSEd4WVBBdVBWT0RXRG5Qcz0=&h=38c4df4267624cbcaaf9e0adbb56fdc7&s=AVNPUEhUT0NFTkNSWVBUSVbZ90i7TVFmrubF_gESPY1VlmKUMmjgpZkCGjW2NJ0O4w
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffbc85dc188,0x7ffbc85dc194,0x7ffbc85dc1a0
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,3422389577200152541,13382073669322841148,524288 --field-trial-handle=2328,i,15390597210418821440,2086949969601236104,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,18098040776089717468,3788225648601896846,262144 --field-trial-handle=2328,i,15390597210418821440,2086949969601236104,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,8660901503182554299,2350656966087250592,524288 --field-trial-handle=2328,i,15390597210418821440,2086949969601236104,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,5228858749335396158,3920969462852654849,2097152 --field-trial-handle=2328,i,15390597210418821440,2086949969601236104,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,2296839453454205304,6999393565245834636,2097152 --field-trial-handle=2328,i,15390597210418821440,2086949969601236104,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4916,i,17161091889920057741,8500878764768461301,2097152 --field-trial-handle=2328,i,15390597210418821440,2086949969601236104,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,15209598244746851727,16882975615606761393,524288 --field-trial-handle=2328,i,15390597210418821440,2086949969601236104,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,11811155853342264170,4087957370618352051,524288 --field-trial-handle=2328,i,15390597210418821440,2086949969601236104,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,13414412808826363389,10996785557220896186,524288 --field-trial-handle=2328,i,15390597210418821440,2086949969601236104,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,13414412808826363389,10996785557220896186,524288 --field-trial-handle=2328,i,15390597210418821440,2086949969601236104,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,6492647601871565786,7746331681186144053,524288 --field-trial-handle=2328,i,15390597210418821440,2086949969601236104,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,18276277877421929161,9058939315026367432,524288 --field-trial-handle=2328,i,15390597210418821440,2086949969601236104,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,10258118832556358183,7846280744469890207,524288 --field-trial-handle=2328,i,15390597210418821440,2086949969601236104,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,2978727336017914087,3574904341019091546,524288 --field-trial-handle=2328,i,15390597210418821440,2086949969601236104,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,11118931742540417989,16462720669772608707,524288 --field-trial-handle=2328,i,15390597210418821440,2086949969601236104,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,6189351318248181442,5585845672802984567,524288 --field-trial-handle=2328,i,15390597210418821440,2086949969601236104,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6604,i,5315267656394738350,4908529356527575026,262144 --field-trial-handle=2328,i,15390597210418821440,2086949969601236104,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:944

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 21c9186551769820fc7e8cfeb2d27fe8cd6bc1eb4e470b8efb97a5487f99cae0
MD5 d9be480929afc63cea645361b62eda41
SHA1 e93e4f83edd026d329f35b0cd0fe40d36ee6c19d
SHA512 6fe0178341629e6581a9a7e6ef2b6daa3d8235b392e686f3a41bd6bd007e6963add7ad4259729a92ca7f652bec648cbc283f3e234c05b868597d468aa7253a0c
SSDEEP 192:4jtr6B3222gtgtgtNNeeLrLrLrLrLrLrLrLrLrLrLrLrLrLrLrLrLrLrLrLrAbh:4jtr6B3222gtgtgtNNeefffffffffffW
TLSH
T161F1524683D5DBA69F0511CB4D94625E00B0370FFBDCEE0823DCAADA704EADAE4E7590
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 151B
SHA256 638fc7e45a745683ad16c83c4be835e65031503a39b5c456ce140c71d890910e
MD5 00a76bdd21b71faf50b8ecdd6027696f
SHA1 1e4e7650207c1941c05d1eda32fed3a6de831ad4
SHA512 263500319a5bd0ee03b7aa67af740ba8dfc0c9724a4ccff796526f04be4f699eccb58c2cd738fe74cb967c8096a9d5e6ac7d4ebc11dc1c72a2e721a58da4a4f2
TLSH
T1E3C08C7938DD681AEAA8287AA34AA0040FB042052022FC2642B8EE847A815A40A5A124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e6babf633a5b6681389a59faee3929a4169435b16dc2fc33dfecafecac1fca0d
MD5 f5a5a6bd589be75b12f39f017e494bed
SHA1 847f4135ec26610faf0b5a31494854257dafb75c
SHA512 b48e1c3f9e0bcd0a6def3bd0f864df6d9d8afe7b8713baa3783dde3329d1cdd348b991674b8900a381bc8dbf68120341e6e1ba481a72875f24fb18c4eb69ab88
TLSH
T13CE02B66CC21FC2718FD5728A009465BE70113572680894F3E3C81088FB563745C695C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6e91f703414c21df62925c35a3771f9ec800790c19dbb71a10928bb33ce1ce22
MD5 796ab3d96d2dd4c384606fab871fdbfe
SHA1 ba8f2983983703f136b18b6f573548fc3aa50083
SHA512 c5bbaa68ffe77a14bf9ee8c851bec78369323f97a7e5220560c95402d10d9ec50225a89202f868a7ebe5cdc5bc768f60b60cf42c2f4f44bf5eefaafc8ec2ac40
TLSH
T17281F83009C342AAF760013381DF194CF9B7CDF9FE276F9168A0A8B5132B7B185ADA11
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587124.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587124.TMP
Size 3KB
SHA256 e992d8a6fd6badd043cf500d6fba4a596e45dbf882971508b73ef04cabb736d8
MD5 69df615ccea60d6187c243a504db9fe3
SHA1 a810a838213188d54a4dbff2b402157e2a78cc5a
SHA512 accea63e8e0703991c3fc4a88ef1a3e1b8dcde7b3b959e53822edbec27b5a507f51a25f4c02ebf23b131710c2b93efe268d1bfa2bba811b13e3bd3becf9d6086
TLSH
T1C381C53049D352A9F360413381DF054CB8B7CDF9FE276E906890A8B1232B37180ADA21
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ddc52842ef023d9143df9ac67c60a9a81d42fc18c40d69d8ce94c41f4abb43bb
MD5 798c84bf98a5b38f91dcf2099c4a2014
SHA1 3adbe88f734e081559b0aa2e0ddac1969da5c12b
SHA512 d656ef943e6c01637aa179bb2f9b7d2a9a0634798b1de885d79649ce78abd8849cf1d84f4830694dc62b012af899244f3d631bc9fc2fb013613bcd8151450f52
TLSH
T19D51ACF783F4856E9B1196F0AA18BE1FCE6C0615436C3C6AC5E4AE2797E3471E001A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c7ce812857130a076cf85df402030279e5b5b2da8e4d8f93c041727e7c554f26
MD5 2ffb26b016474470b7254f47b9cb0226
SHA1 ecf32dced19893b5680602b26b887fdc1469de6a
SHA512 4d187949473f079af0e2008fd47b91b7d5f07205b9678de41ff09cd6a7d40f12642e819163ec83b33ce5726e66a49b526b9a2dd2bff94f928c6794a7521d552c
SSDEEP 192:sxZC0RCyMqZjK1Ml8MkS/fUssNOaZdGzodpT8aHW6+WNOft/YvfuguaGIgjwJ:sxZl3MS/fUssNOaz9vHbo/NXjU
TLSH
T19B72F816AA64697BDDDBE219F645BF53D3F90163A1904E449DFC8A1C00E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 e8f466944f7111f51f4f5b376357e2f56903fd2aaf9d7d15533bcdde09e3c329
MD5 767d26e4b4b696d66532a736ff722bb5
SHA1 a09d6906634f185108af22878d337ada3daf4f1a
SHA512 a1f4263cbcac69b64276d62baa6747c79072f3c3b8eab8467b528cc37ff38b85d4e4ba5310b1c30424f00e01acf45d1ffed85a5bd82581bd00db19cfefd52c6c
SSDEEP 192:sxZC0RCyMqZjK1Ml8UQCkS/fUstm2ZdGzodpT8aHW6+WNOHkXYvpgraGIg5fwJ:sxZl3qBS/fUstRz9vHbJXXX9U
TLSH
T18C72F846A964A97BDCDBE219F645BF53D3F90063A1904E44ADFC8A1C00E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\534ac8fa811925c74cff4ded87750e6a894fbecf\45f12585-82de-4c7f-b212-0d6092e145de\index-dir\the-real-index
Size 72B
SHA256 73c2ae2833fc26352ed7ba89e73ff96e3fe01ff0c5c436999b960aaf25fab28b
MD5 d6df781d1a6168372f7fa21f62ee8bde
SHA1 98d8284cf1c52800da4167fed62afd32ac05a4d2
SHA512 437404461ebcfc4074a06f370e410c88b9559199732b5143097828da35572c729d562e0eba7dd163ae4d4f85b6023c56c9c83cf67f431afe7456b7c9442a5a06
TLSH
T16FA002E8058400E2ED1153F020655B5A66115D681A111313C8FD2049A855751A253025
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe583f75.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\534ac8fa811925c74cff4ded87750e6a894fbecf\45f12585-82de-4c7f-b212-0d6092e145de\index-dir\the-real-index~RFe583f75.TMP
Size 48B
SHA256 e407deb5972de21e5b508296f5b25cbb8916bf7ce8deb3565585b7341cd63a9e
MD5 6b091c124e12b9b0851b5b8d69fc79ae
SHA1 de36d1581b5e91f87014b0e5a23d7db6cbde2d03
SHA512 3d1605b622ca4ba50d221c0825a898c73f5f201ce70b22b62476a245f63464763184537759f5bbd9d363b5948e456726b16a92e5a6442973082862ea4f3362ac
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\534ac8fa811925c74cff4ded87750e6a894fbecf\5a631775-ec24-4487-a201-b8648e1bcd0f\index-dir\the-real-index
Size 72B
SHA256 5a0edfbb681e9303e5b0cf713d8a0dd339627cb40326077752d4c71b77a36592
MD5 3538681782de3d9fbf0ef196a0c3559a
SHA1 5dce995bdc6a1a2ef8a33a67b0d63e3e83a1fea2
SHA512 1c403aa224c1e4e111de0d95d236c67fe6c6d3d898e10f7c4d7199f55e7dd41de41d017683f1b4db61ffa2e5f3b775927dd789ab0c54407921b94a0e5cfb3aed
TLSH
T186A002D34A644045DC0C4776D367255073308C748D4DC7C750A521C7DCE02949583021
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587088.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\534ac8fa811925c74cff4ded87750e6a894fbecf\5a631775-ec24-4487-a201-b8648e1bcd0f\index-dir\the-real-index~RFe587088.TMP
Size 48B
SHA256 01870ea7f514212cddfa39d6598dd7f79307de7d2e239880b3aaebd39eb4ab90
MD5 f90a81b95f8cdba40f2a96c3066c78a4
SHA1 3ee724481285acb487283a1e3529e7f9f832cb0e
SHA512 2d09d576ea554dfa84dfdfa806700711cf08970e69ef131f117839901b5ff9839ae4b034c6a508b373e441380aa6b5562ccc836c0ac76f55866d46ae12578899
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\534ac8fa811925c74cff4ded87750e6a894fbecf\index.txt
Size 248B
SHA256 ba63d4576105189cacb5c897b0368e251df1ed908d7570b85356dde6e8f304d9
MD5 266bbcd0664ebfd031df4ff32ebe75b1
SHA1 f83bdd873774c713c431a07b20dbed9984caec02
SHA512 1e010c16adfd219f218de62e79670765d297235bc16b45d9d61ebeb25d98a343e85e314ef9df077d23c226eadaf2899ab4b51f1fef25dc20955b9541bbdd5521
TLSH
T1C9D02EE380E59A82F6A2564381A6C280CE2B2E8F2C48600C0802610C3676D84CB81360
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\534ac8fa811925c74cff4ded87750e6a894fbecf\index.txt.tmp
Size 243B
SHA256 77bb44d60bdeede4ae899e5dba502a40d497e8803c0dc3e31c085920096021c0
MD5 84e090c61f3a734c7b0af11d353a9597
SHA1 b67c361daa19b1a1c774d6ac862861e0b13c07fd
SHA512 c965be972cdd2a2515494bcaebb37573dc272088b305eea031c6cc3d6d24f37b1f851c6cdc560f00abc1c443e26b162cd42c44469e00c222001b6d02a0e52b4d
TLSH
T128D097F3C0E99B82FAB3964201D6C390CF1B2A8F1E4C700C0802410D2766DC8C3813A0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe582268.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\534ac8fa811925c74cff4ded87750e6a894fbecf\index.txt~RFe582268.TMP
Size 155B
SHA256 64283c98b1dc8457d1ca427f2bf8c13e31007f12121e94f2fc51e2f83b8fcfcd
MD5 e1dc484158f74f1bd8fc95ae9b154629
SHA1 49102de556205213d9aed499b35ea8cdfac55461
SHA512 e28ff0d5cede8706934477957c373543595c3da9a2641eead1ef55b37797fa92535d4a1d7f1d1967c3caa0e8882dbdd19f7e4287980f17fc6e3c4b85fe718280
TLSH
T11DC08CF7C1A6A781F36261D38086D2199F2B4E4F0C44711C0607B90C2A39CD4C3C6725
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 de68251354d53281e8d7d3aec4c0d43da91fae0119d163e706e6270511b26f6d
MD5 dab833b9e55ea68d41b0794f5ddfe85e
SHA1 4c66fe996670afdf7f744bc4615006e60642b90c
SHA512 b9a8a95e20e86f72be7f831aefe95915e05f9ada50e0b02ed5f7295f7149400f0a97dbcd82a67c5eababdfb6576755e4b79966d76352664cbd0455142421e7df
TLSH
T179B00226416F9697CA0427F5B887306D3AB40C25634A33724DF8D4F8DC617D191A729E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe583d04.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe583d04.TMP
Size 72B
SHA256 d69dcf8b9bba0fd483ec2ac3bece09f63cc29f5e2a7602ec26d467c2ad356fbf
MD5 16addad6dbf69c7ba42dbcee0442d10e
SHA1 0c5e5912a84f2de63db5c63191da494002cfb0f8
SHA512 044d645f86b286fac4d6be401e3a814c0a4a42c019b1b78147f30c1ef2d0f1148090605d2121040a410af1ad845a84fd2a3c34fec7cce13a4258ed7cad2fe492
TLSH
T123A00216824A6448C45019F1100F2271D750CA9D23401B0A45E0B09CEC918C455B564D
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 79557a81feb366b90011dffca90e6f0764caae22bc138722635ed6d12e6976e8
MD5 e2bf85b2bef79239122532e6eceed701
SHA1 e38e063225404f5a90c277474bacc8066e7a2818
SHA512 c900135f94b6ced923414b949d76a3aa8c60be54c8933d45bd03c8f5c25e72d5fdcbf651268f06cfef150c8c0a0425f44396b4112263d8eea98589a767d5d430
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGz:05ppxnY753RNBvRJJdt7p5J9VlfqHg
TLSH
T10FB29A1A713F0212397E2948B39696364F4235A37058E4AF7FB804A54F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 5ca23c3256913ef04155702d210d90abd1609217b4bdc9944354053d6c4462df
MD5 e67d86e1e640be7941088be343b7cce2
SHA1 5177d495a99b32a188d72b5553de8a68d8951721
SHA512 93793bb9054fffd0ddf8b3129ea4650637bc8fd45f60d18f0bbcba77c5420306c8318cb536b760bac1c7f563756633322d83cdd9574653caebf1ae862be1f25b
SSDEEP 384:nViFiZcIu3sN98TUNTUlI4dQckCr2Bb0phBftGnvPugLGmOOPrXLpe8C/Zty/7IZ:cFQu3IwgSk/bS1GvPugLDOi9PW
TLSH
T1C5F2C4F198D79977E8AE4B87A77D2E029AFCC153B5885684BBD84D0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 22c947b8fb46fed8abf2d42f29ca17a2ceef31eb819ba6274ed8752445effa4c
MD5 af6bd1dd753f6b57ed3825ccadd98061
SHA1 c62f0aadb166ea3a490a1bb64c1d887583a0d65b
SHA512 c195babb6d5ff5c55fc6ff1aa7d183cd92bd027d2d4bc3b0226635b0975cf454e464eefd81308b7eb35c6db2a25412d914ad9c77d6e52499be41fa8d76e03318
SSDEEP 384:npNiF9CcmyWCs3sNj8TUNTUlIm2QckCr9l6KphBftGnIRpae4KV8p0mHpty/7IgI:pEFccps3mwgbkUYk1GI2I8p0wd
TLSH
T1C1B25B36DC58C9BBECE74F99BB4A7A03EEE41267869899D4DAD81D0D108719D030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 fc89f93b51435922cfd8b47024702db529b10fed1d59aa494bd92f9681a4f085
MD5 ac01da3870cd1641f9852bfade2580b5
SHA1 e236b1f3a815c2668a2e4eca61e141cc266be053
SHA512 609e3795bdf678274f53ca0245eccef5710be34474021098325320ed2b25ee702719cf1b636841f185ccf5ef3e87dcf6a504567e754ffbceb97eafc74228736b
SSDEEP 384:npMiFiZcI+3sN98TUNTUlI4EQckCrsBo0phBftGnvPgLGmOOPrXLpe8C/Zty/7IZ:p3FQ+3IwgLktoS1GvPgLDOi9PW
TLSH
T112D24B36D8A4D9ABFCEB9B85A74A3603AFF44163D6C85AD4D9D85D0D00C719E030BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5656f61531136c2e88a7a639902b624e789bf625090dd57c7ec068e51dc5b0cc
MD5 f473bb1ca19681f26e3a5a3bb7b4f82f
SHA1 645a1204ec6b4f31e7e8fa607d7d1cb3a4766e96
SHA512 6228a4e6485b4ffaff09567a7f905cb220a13665a4551bec55326a303d252c3a872549d5a25bf1fde2ebf7fba67c160ee0c61969c403f601c888581dd9fee0fa
SSDEEP 384:nIiFiZcI+3sN98TUNTUlI4dQckCr2Bo0phBftGnvPgLGmOOPrXLpe8C/Zty/7IgU:TFQ+3IwgSk/oS1GvPgLDOi9PW
TLSH
T15AD24B36D8A8D9ABFCEB9B85A74A3603EFF44163D5C85AD4D9D85D0D00D719E030BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 17917d667b67e6b0c47ba040088a1280a0a5e044b5ab8ce00d9a542b41873598
MD5 2c422f6e0844022d742d28535243c985
SHA1 e4417ee4aff6bb384ba45057c6ecfddaffc2e540
SHA512 6886242840427e948d18b801746894b3e7b6bc1aab5caf2ade702c5fcfb49e82c37dac8b5ff50b66a5dbeba70168629407d9b68ffac3898b07d1825241113763
SSDEEP 384:npoiF9CcmyWCs3sNJ8TUNTUlIm2QckCr9l6NBphBftGnvtgLGme4KV8p0mHpty/q:pzFccps3YwgbkUcNf1GvtgLDI8p0wd
TLSH
T135C26C36DC58D9BBECE74B99B74A3A03DEE04267868CAAD4DADC1D0D10D71ED430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4dfde7b7f7bdab10218abb191896e2900115a2b2792b3222976b2479e61ebb71
MD5 65a61b47ecabc05d5bfdb7738c3e676d
SHA1 09f743a0cd6ec126367c1c7b2cb87e52cd34b101
SHA512 3d65802a789ba1afbc551588df4478dff00958d89a414083afdac41606888a9be065000648c48e29474834eba0de24f57d6293b23494cebd3f856e415c755c0c
TLSH
T1F8412798BBEA1149B3B36F5A9BF6A86D487F78332E06D05D00010E4E0663B40CD71B37
MD5 SHA1 SHA512 TLSH

Submit Download