hxxps://kathy-lib-comes-south[.]trycloudflare[.]com/webhook[.]php

Analysis

user interaction
yes
max time kernel
10s
max time network
10s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/09/2026, 23:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://kathy-lib-comes-south.trycloudflare.com/webhook.php
Sample260926-296ajstdmb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3624	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{9B0F330A-DDB9-4FA0-A3AA-237973B87DE4}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 3552	2920	msedge.exe	88
PID 2920 wrote to memory of 3624	2920	msedge.exe	89
PID 2920 wrote to memory of 2104	2920	msedge.exe	90
PID 2920 wrote to memory of 2104	2920	msedge.exe	90
PID 2920 wrote to memory of 2104	2920	msedge.exe	90
PID 2920 wrote to memory of 4140	2920	msedge.exe	91
PID 2920 wrote to memory of 4140	2920	msedge.exe	91
PID 2920 wrote to memory of 2856	2920	msedge.exe	92
PID 2920 wrote to memory of 2856	2920	msedge.exe	92
PID 2920 wrote to memory of 2856	2920	msedge.exe	92
PID 2920 wrote to memory of 3464	2920	msedge.exe	93
PID 2920 wrote to memory of 3464	2920	msedge.exe	93
PID 2920 wrote to memory of 3464	2920	msedge.exe	93
PID 2920 wrote to memory of 2584	2920	msedge.exe	95
PID 2920 wrote to memory of 2584	2920	msedge.exe	95
PID 2920 wrote to memory of 2584	2920	msedge.exe	95
PID 2920 wrote to memory of 4244	2920	msedge.exe	96
PID 2920 wrote to memory of 4244	2920	msedge.exe	96
PID 2920 wrote to memory of 4244	2920	msedge.exe	96
PID 2920 wrote to memory of 4712	2920	msedge.exe	101
PID 2920 wrote to memory of 3220	2920	msedge.exe	102
PID 2920 wrote to memory of 4712	2920	msedge.exe	101
PID 2920 wrote to memory of 3220	2920	msedge.exe	102
PID 2920 wrote to memory of 4512	2920	msedge.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://kathy-lib-comes-south.trycloudflare.com/webhook.php
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff9bd0cc188,0x7ff9bd0cc194,0x7ff9bd0cc1a0
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,12850628514895176367,14176405908521164843,524288 --field-trial-handle=2300,i,4429495291976846609,13856817592558473696,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,6415397760994696731,13500241840332686700,262144 --field-trial-handle=2300,i,4429495291976846609,13856817592558473696,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,10691945299106000794,7954530040700668523,524288 --field-trial-handle=2300,i,4429495291976846609,13856817592558473696,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:8
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,3049521940120577668,2088872273691472647,2097152 --field-trial-handle=2300,i,4429495291976846609,13856817592558473696,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,16997028795231559028,9851084787622531017,2097152 --field-trial-handle=2300,i,4429495291976846609,13856817592558473696,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,13723734788503152916,5668857987294906195,2097152 --field-trial-handle=2300,i,4429495291976846609,13856817592558473696,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4156,i,16805962796467631665,17286500662199353092,2097152 --field-trial-handle=2300,i,4429495291976846609,13856817592558473696,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:2
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,11571598413224204292,12764132841700184697,524288 --field-trial-handle=2300,i,4429495291976846609,13856817592558473696,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,2805287771352779374,17473961617144796826,524288 --field-trial-handle=2300,i,4429495291976846609,13856817592558473696,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,4309583478473237143,15575136284133636203,524288 --field-trial-handle=2300,i,4429495291976846609,13856817592558473696,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,4309583478473237143,15575136284133636203,524288 --field-trial-handle=2300,i,4429495291976846609,13856817592558473696,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cb29521835d0887aef733d211fa43d2903333bb5e86e2580dbfe7db3b16bb1ca
MD5 ae441104cfb514988d8468c296b33f4c
SHA1 1de1bdd3ad0b87ba57d165cd0d5b72d99a1a48f2
SHA512 4178d6169908ca49fae4773c8986a0c9d71a515b2fb4d7ce8fb9bcc8b10c415ac00698c7add7cc45f427547535401a518211221bcfe6dfc2bdc0f71f62b0105f
TLSH
T150D0C028AD78EFF4F021113C0330400031CF88138642210A58610D174C302C30380DF0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a9e2856f7b8bdcf4e651903050a9f78a4dcadbc91b2bacca38c04067256642f
MD5 8eed843072749c683b08c3e5dbce9bd8
SHA1 87464a0b34e45a134ed6f01b613378b3b1c952ad
SHA512 ce7dc7d95703c8a1e763fcb3eae4091d89a746632583bc1fc73a8c189a11f08c6f50e2ee328053aab1da82c11d6f5f81942259c5654861d13f267c34e76feb7c
TLSH
T199D02B6CBE989EA0E40210340231910431CBC8178442200648B1065708003C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 221e3dccb30d516b1b3c2d51c604a308dfba3aa3dbe8e11c2d09e185e21df465
MD5 7c97d945db36fde78f76660ee3165916
SHA1 fa851b1197f5a5f6ba4d935baba30b0465e8ad12
SHA512 73a256bc0b95a0662925ed2ac0e1668d7a760da5001e2b32fe139724419020254e080420b21ccad1896c60c44ca2663c2a3d2eccb8cb4180b6b0ad628c68d676
TLSH
T14FD02B6C7ED89EA0E80210340230910431CBC8178442210748B1065708013C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 127KB
SHA256 e5f1dabe89a7a1d0ae94bd8e14a273cb5144a6541c34a54192411677c18c43a2
MD5 f944721bd55cbb39c452593638459aa1
SHA1 085940738cf5737b614a586d0f2005ff0445d6e5
SHA512 33c8c2882fc81062027733dc7f1d52f2194957cf94b34c6d71e393ed90f37a378a5c7122cbfe4dc35f7e63c26f7c4440886e9b3884663aea2a8183087611b3af
SSDEEP 24:5bglATIKl7DCmTpHTyxpEo1HM9kvfkzyfkmoyfkoRfkIRfkwhNfkm7usyfk6sRfn:qlg116z1+ukYkwkAkgkw9kugkxkY
TLSH
T107D3356D2F958FEAF0F12770E684BF4CB3D96E6251EFC35E1BCC1906BAA00D01048A85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fd5957763d709e827cb3d3e1949b029ca1bd368623102d9bc15c9b113cf8de38
MD5 54289a201b7fc8a5beb766b40fe87146
SHA1 34841a6283c884d1c933c0314fd7d113891c8cba
SHA512 fff02652275c2a0fb0e7a14b4064c5c98336333f2f61b1345ec9af17847b2a43373037a67b018fcdd4bc1afd60865ce9426a797b11e5618202f1ce9c21992bd3
TLSH
T15D6182C1689640BDD79803B0BDED2CE7B53C1AB966A3BD01C59BE43DBB4A3B412072C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588807.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588807.TMP
Size 3KB
SHA256 681c9187a9dbcb801badae82296d4c8386ec31c9a561c7db0c9ac134753d5315
MD5 d7664cd50d1b7070a714a610562f514a
SHA1 a670d38aed86c03f9d3a64f5dc12b864a5a00b67
SHA512 ba6e2665998262d8651f070a057d42e64f84d5917d03d8127ad763f87656e9e2a5e086448d26a4eaf02bfa297fcc617f36639e5c1a2b732869812cbb01b28736
TLSH
T1986183C1A89240BDD79803B0BDED2CEBB53C5AB966A37D10C49BD43DBB4A3B412072C4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 eb47a65f2ce1f510dbcbad199392dc1061340218dc65cc3e76ab633c5ca5631e
MD5 373f13d3647ff5c80027aa2eaf3ccdb5
SHA1 b6b1442fd9baefc9745e4515b8db1e36bf026966
SHA512 08bfafb32b488432f3fe565b6e9ec3a4e5d7f3ba4889ff5ae63ce5e0bbb2bbdbf7e641f52759b3e05c68160911480a982d8e68a3d20e5286e30a33f2fbe52360
TLSH
T10071EEF6C3B0552D6B8149F4AB146E2ACF9E08164BAC789FC9D04F4BD7E2172C200A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5138b33d65de12058ca0eb48d77950b9da2d6e05c8cd1a5046171d83db3e541b
MD5 b6bdcb3e1a1d8f39e196661fa62c8d2e
SHA1 81b45449b8daec791d6ccc5aeaddfaddf6c5b089
SHA512 c371f2289bca3a9c0ba0838e575871443af1a48e60de15114b6d43bdf70aff7b78c58fc3114a0a31100f44ac585d5d0dfb76bf86c85e8b729914173f95878ce5
SSDEEP 192:sxZqRFWv/fcsvWpV+QhIdpxOHW6+WNP4bg/Y36DrRIgFJ:sxZqqv/fcsvWv+QKYHbz/tpv
TLSH
T1BC32D8156D34A97B8CC7D21EBA257F53E6F94032A1E01E98ABFCCA1C05E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 73937478959c83f50a6c0093a4466ffd5a4275044089c9673d95778ba896c35a
MD5 850d92529c946692c2fce2f70fc140d0
SHA1 9aab54f529250c4f74430a42c08212150a40896a
SHA512 83190a80b9176fcfcd8fea5f19b3f79eb11f4302b1ccf3fd50f6297d345d1be8767f9172df21c9178bebaf4e1a9d40643ee2b7fcb76a12f4a901a529c5cbdfa4
SSDEEP 768:Yc30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72XrolZM5x:Yc30AbSWvS2l9u1jaLmLZ12E8
TLSH
T1B5C2DA3B640CCA7E4FC05A9DDC6AAF9B6E9C02C796648D4047FA944C02C77EA91274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6a2e7c74598171f9844dd1dfbd37bea9bb17eca71dc32300a24570954fcd7e6c
MD5 2c255ced7e836814c738af74aa152ee9
SHA1 1c89b7e38918a2b59614b48267f0cdda10c0abeb
SHA512 60e80cf50d61b20386524faf27aded03438c033a3b5fb30098a5b917857bda7136808e790e5f8d6a2e12bbc4aa72114d9f0046911a9ba0d04708d6f654a4bcb0
SSDEEP 96:KwhyKSQSmdiK2o2aJ+aoIYCmg/xsqCKEnsUCQKyHsarJ14nDd/e:QpN/JN
TLSH
T18891162434B75240797D3A5D86A59B2E224135733029E53FBFBD00A64E2EE080EFE8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d5e02b9939e52ddac24240d730e1fd7ac16014b689ed52da4b2846c2eaf7b167
MD5 3464eaf1de47a93c33d1b41baf9a5ab3
SHA1 18bccf958bcd60ebbd0027f402a810570c3455b8
SHA512 6a42a13d9ee0ffcb822fb4eafb73f1a812bfdb3d022cc4c587528a4087851e24898f5846ea34da5b0b2ccb631d7093ada40352a0c13e96583e2310f83c67ddd5
SSDEEP 192:LONe6AmwprQmiUyEg6siX5FvY+9JiDXU6:LONe6ipd86siX5FA+qzU6
TLSH
T144020B35AC686C7B89F3AF15B48B3B239FA5117BDA942F84D9E81B1C01D764C1307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4c534f1539f680c17cbed628037326790a493c7d90884b60cc32c79ec1399a08
MD5 03233535c1ae3c137de971d5c46f504a
SHA1 af85f68b995bbe570376334b1b32cd90b58730ad
SHA512 45a5fb24037df5ff9f95b97968a988c34284de000e7acaa2509353ae7b5755446674046b89517132a8a9e7918c477dfd7d632fe7d7b886b94bf9e64c5cc4741b
SSDEEP 192:LON36AmwpRQmiUygg2siX5FvY+eMOlRjqz1U6:LON36ipvI2siX5FA+eM86U6
TLSH
T1E4124A36B878AC3F4DD2E551F04735139EA9522BEB886F98C5EC1B2C06DB598530B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 36f1d112ec4b97a60e1cfc306218e5cfddbdfda7384283f04470c0d2d40434e8
MD5 eae3b5bb6374527dd147802723ffd511
SHA1 89d40c65da43dccae412eed63f51d866dd097565
SHA512 c9df50da40a5f944818d5771ee110a736cda79aec01fbd2744a0b5419765818fa1eca5cfa0053a455fc5f70ddcf72945d852d2d8594a3918055f5fa215403f07
SSDEEP 384:uoZcIhsNOy5Gpukyq9iX5FA+eMWVeAStL4fockL0VZh6DKhH0oe:uWhEGiuaE+WPSzckL0fYGH0l
TLSH
T16DA25BB1D8645CFB84B5E9D2A506FA036EB85177C2981E5CD5F8BB3D309F8F40312926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6289a8b4ab4ee7ff5d7e7c67183534a54641d899d5991245e4ed2473de8c5afb
MD5 327e96c34463f6ab2978ea868caa7c6c
SHA1 e26aa2f5a283fe63990806aaecabe6200a7f6092
SHA512 16f82548660c595602a67d65414d6c747b58dd07fb4b26d218e4991d52902afa94b5a296558da177a7cc4ef030837ce09d21a6f90b72de9240a9f4b22ae2fa66
TLSH
T14C411A58B6FA1104B377BF569BF6A86D887B79772E06C05E00010E8F4A67B40C962737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads