hxxps://forms[.]cloud[.]microsoft/r/QaGHL93EAD

Analysis

user interaction
yes
max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 11:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://forms.cloud.microsoft/r/QaGHL93EAD
Sample261027-ngfbrstthx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2924	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{4260B09D-EF10-41C5-B842-47928C77DE50}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 2364	3776	msedge.exe	85
PID 3776 wrote to memory of 2924	3776	msedge.exe	87
PID 3776 wrote to memory of 2396	3776	msedge.exe	88
PID 3776 wrote to memory of 2396	3776	msedge.exe	88
PID 3776 wrote to memory of 2396	3776	msedge.exe	88
PID 3776 wrote to memory of 2644	3776	msedge.exe	89
PID 3776 wrote to memory of 2644	3776	msedge.exe	89
PID 3776 wrote to memory of 4588	3776	msedge.exe	90
PID 3776 wrote to memory of 5112	3776	msedge.exe	91
PID 3776 wrote to memory of 4588	3776	msedge.exe	90
PID 3776 wrote to memory of 4588	3776	msedge.exe	90
PID 3776 wrote to memory of 5112	3776	msedge.exe	91
PID 3776 wrote to memory of 5112	3776	msedge.exe	91
PID 3776 wrote to memory of 4484	3776	msedge.exe	92
PID 3776 wrote to memory of 4484	3776	msedge.exe	92
PID 3776 wrote to memory of 4484	3776	msedge.exe	92
PID 3776 wrote to memory of 3232	3776	msedge.exe	93
PID 3776 wrote to memory of 3232	3776	msedge.exe	93
PID 3776 wrote to memory of 3232	3776	msedge.exe	93
PID 3776 wrote to memory of 740	3776	msedge.exe	97
PID 3776 wrote to memory of 740	3776	msedge.exe	97
PID 3776 wrote to memory of 4664	3776	msedge.exe	98
PID 3776 wrote to memory of 4664	3776	msedge.exe	98
PID 3776 wrote to memory of 2640	3776	msedge.exe	100
PID 3776 wrote to memory of 1704	3776	msedge.exe	108
PID 3776 wrote to memory of 1704	3776	msedge.exe	108
PID 3776 wrote to memory of 1704	3776	msedge.exe	108
PID 3776 wrote to memory of 2440	3776	msedge.exe	109
PID 3776 wrote to memory of 2440	3776	msedge.exe	109
PID 3776 wrote to memory of 2440	3776	msedge.exe	109
PID 3776 wrote to memory of 1896	3776	msedge.exe	110
PID 3776 wrote to memory of 1896	3776	msedge.exe	110
PID 3776 wrote to memory of 1896	3776	msedge.exe	110
PID 3776 wrote to memory of 2780	3776	msedge.exe	112
PID 3776 wrote to memory of 2312	3776	msedge.exe	113
PID 3776 wrote to memory of 1552	3776	msedge.exe	114
PID 3776 wrote to memory of 680	3776	msedge.exe	116
PID 3776 wrote to memory of 680	3776	msedge.exe	116
PID 3776 wrote to memory of 1012	3776	msedge.exe	117
PID 3776 wrote to memory of 1012	3776	msedge.exe	117
PID 3776 wrote to memory of 1012	3776	msedge.exe	117
PID 3776 wrote to memory of 1552	3776	msedge.exe	118
PID 3776 wrote to memory of 1552	3776	msedge.exe	118
PID 3776 wrote to memory of 4304	3776	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://forms.cloud.microsoft/r/QaGHL93EAD
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff9c411c188,0x7ff9c411c194,0x7ff9c411c1a0
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,4239462783939304439,10827027136165020028,524288 --field-trial-handle=2612,i,11350867384537858759,824362072897348997,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,5476655909499489421,10584458415465457064,262144 --field-trial-handle=2612,i,11350867384537858759,824362072897348997,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:2
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,12829394872665401652,17759018662297754127,524288 --field-trial-handle=2612,i,11350867384537858759,824362072897348997,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,5432482520561552453,5269921398384505621,2097152 --field-trial-handle=2612,i,11350867384537858759,824362072897348997,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,14248791097413936569,7342066921019521399,2097152 --field-trial-handle=2612,i,11350867384537858759,824362072897348997,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,1289164260729991868,8088008847251253626,2097152 --field-trial-handle=2612,i,11350867384537858759,824362072897348997,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,5448065598201547240,15506641628278686909,2097152 --field-trial-handle=2612,i,11350867384537858759,824362072897348997,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:2
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,10208904502072233700,4643444148726152,524288 --field-trial-handle=2612,i,11350867384537858759,824362072897348997,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,5155547337375922752,1112911877852800582,524288 --field-trial-handle=2612,i,11350867384537858759,824362072897348997,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,6025110148439160225,18143384288698647314,524288 --field-trial-handle=2612,i,11350867384537858759,824362072897348997,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,6025110148439160225,18143384288698647314,524288 --field-trial-handle=2612,i,11350867384537858759,824362072897348997,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5908,i,12807388475815020498,6181847370182143675,2097152 --field-trial-handle=2612,i,11350867384537858759,824362072897348997,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4372,i,8635604679855999853,17110544120376451266,2097152 --field-trial-handle=2612,i,11350867384537858759,824362072897348997,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6312,i,848063835974392038,8735794329864354946,2097152 --field-trial-handle=2612,i,11350867384537858759,824362072897348997,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,1847769423326114746,17941213738290897121,524288 --field-trial-handle=2612,i,11350867384537858759,824362072897348997,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,8736454192127739467,1724343810775581133,524288 --field-trial-handle=2612,i,11350867384537858759,824362072897348997,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,1747949586982101852,2431531461646711412,524288 --field-trial-handle=2612,i,11350867384537858759,824362072897348997,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,10404107212343325571,8740401840966875217,524288 --field-trial-handle=2612,i,11350867384537858759,824362072897348997,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:8
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6788,i,17355030171151902848,8407023229630540370,2097152 --field-trial-handle=2612,i,11350867384537858759,824362072897348997,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,3761989403297499413,10448826748754905561,524288 --field-trial-handle=2612,i,11350867384537858759,824362072897348997,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5768,i,16120044554510410521,7827967184634213433,262144 --field-trial-handle=2612,i,11350867384537858759,824362072897348997,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1759aab3-e85e-4348-a8f6-bb858d46cc19.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1759aab3-e85e-4348-a8f6-bb858d46cc19.tmp
Size 21KB
SHA256 e1ad3530c7c4cdeae83922ba513dc2596e1ee6f62e0b4d035a7c434eb470868f
MD5 3f7fc7f544f3621f980bf00f3fd143fe
SHA1 1ea3374a280370f19aafb1cb4f3b606e7809cacf
SHA512 54c8ba50eae8ab2740556c99415485db5ccb637afc3de65a6f463e32dcca12f3cc9022cd7fc3db3cf8ab3ace58882ae4655098021577f2d578f3f81852f93369
SSDEEP 384:3aiFzQkUSvRzsNm8TUNTUlIlUNiGLGJ2QX5+Dtv8XLFXPJr60e/vaTZcmIIlK:3RFdhvwgQxGJ9kDuRPh60e/vaTZcmLE
TLSH
T19DA25D339898DD3B9EE69B90F14A3203DFF05167D9846B90E7DD5E2C01DA1DC230AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26fb5392-c67f-4b06-b6c5-d8c61059a1ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\26fb5392-c67f-4b06-b6c5-d8c61059a1ae.tmp
Size 18KB
SHA256 57138c5b5a14bf08497ed74ff01057d24b19f6f0e63e25d5ec1d4d2453b9e800
MD5 0ae17af6c81c026531de05358fff4fe6
SHA1 a12d217c0b1e9cc270e59cb1c5b851b2ff2e8337
SHA512 ddb305314c0e2c0c25f89522b393f013be05b64294f188a4b77050ee70d2e35020679aadf37e4410d7bc49c22b63ffc7edcb7349fc0775cf5c4474dc5f80042b
SSDEEP 384:6QkUSv0sNmUNiGLGJ2QX5+Dtv8XLFXPJrc0e/vaTZcmIIlK:i0AxGJ9kDuRPhc0e/vaTZcmLE
TLSH
T110827E32A868AC374EE7A691F04A3203DFF49167DAC41F80D6ED5B2C01DD69C331AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2cbf005e-c5b4-47a2-9507-7acf87632fff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2cbf005e-c5b4-47a2-9507-7acf87632fff.tmp
Size 18KB
SHA256 e16c6b8d9657b2c915ad75fff674cc14a4c96091532855c35cbe314d7fe3f7d2
MD5 eac3b280cd8366cb7a9c691b258f7066
SHA1 ac0e568970e0918535a526868c004b1cea3aada2
SHA512 b656c61242246011944517122f9f320b495c815cf85a2206316cd31fc902de2624551f0e764f29e1d8840a18a4209ebaf33726e60b910844ec056157d8bc0c01
SSDEEP 384:+QkUSv0sNmhNiGKG4QX5+Dtv8XLFXPJrc0e/vaTZcmIIlK:u0xcGrkDuRPhc0e/vaTZcmLE
TLSH
T1AD827E32A868AC374EE7A691F04B3643DFB49167DAC41B80D6ED5B2C01DD69C331AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e3b0ee3-26c5-4fba-8546-f0e3fe88df61.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2e3b0ee3-26c5-4fba-8546-f0e3fe88df61.tmp
Size 392B
SHA256 a977edaaf9199aaa35cc2221acf72f0ada0981a62a7474a32e8daab227a07c63
MD5 9fdc2952f518542ef95c683aacb814a6
SHA1 a25ba9906c3f730ae7ae57ea17eea321adcf5863
SHA512 ecd309c129335e07e027c71b74ccefc1fa737812ffdb7561f50a9b4c3d7caba9f9b38ca28345e69014d13f0b68ec224eaedbbd81d8c94096dfcf8ceee68f4039
TLSH
T16BE0020293100196C114873400931B242BE2C420067203460D5001642D133041D58740
MD5 SHA1 SHA512 TLSH

Submit Download

649946a0-e35b-4f20-a0e8-24196471cb16.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\649946a0-e35b-4f20-a0e8-24196471cb16.tmp
Size 8KB
SHA256 1a2de34192d7b6f79c29b510874fd74d09b990b59132557eaec6c7a80d6ec65f
MD5 2ba4c320fd4b0dd3cecbc84e56efb461
SHA1 ca3e7ead853f17dc83ba8d3a2888ada89f992de0
SHA512 4d539d8f9405dcec95bc112f2f7765dea5d0f52d9a233cfa8cda54b446ed771fee9c28c192e59f3ff0c5e7460b0d9aed70c269232a84b0725a3239f7b9bc5dd4
SSDEEP 192:EONw6nnHGQmiUyUoQYcX5hQDP1HjzorMoLCMc0JzU6:EONw6nCUQNX5+Dtv8XL60hU6
TLSH
T12B02FB35BCB87CBB8EF36E46B48627139F952167E5952B80DAF81E1C00D765C2306833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6563f5ed-8f92-4e01-805b-f2a422a4b16b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6563f5ed-8f92-4e01-805b-f2a422a4b16b.tmp
Size 8KB
SHA256 edc80f8a089bb96bc9bedbf8bc6ba1df921897c053a3a97291e1d230ab2a1f3c
MD5 293b1b83262badee40cdca52cd0b1fee
SHA1 46e724bcde84c2520aa465ace1d68b3f9511d4bc
SHA512 90ff54ddd46cb521335e1b688838f59d290a177de51e017a408ef53565452bb75c1b09cc75ca3e283c7c993df016ccffda5b58aa1b9742855d84c8fdcc5e4e27
SSDEEP 192:MON/6nnH/QmiUytodYcX5hQDP1HjzorMoLFX4SJr+g30trq5/U6:MON/6nh3dNX5+Dtv8XLFXPJrJ0e/U6
TLSH
T1CA121B31B9A8EC774EE3A595B08731139EA45127E6857FC0D6FC2E1C01DEA6C630AC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

3d00c129-869a-4f5b-8998-5aa4a77c14a2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3d00c129-869a-4f5b-8998-5aa4a77c14a2.tmp
Size 11KB
SHA256 09af1d52e3729a04362e7c6b09ba02e473810447ee8217f94e5a8b927810bc87
MD5 4bb13822cba3d5e8ca8a40b9210a58c5
SHA1 a38b08656f7fd4deea67f891e934087b18df52e6
SHA512 db2e17a4e39de6e73e0d64a7efe69f9e15a0862f380fb76e9fb7d8fc4683fd40e05896a1b6d994dfab5c945dad9ed4133f6f4cfe77981949a41b7f12274a44a1
SSDEEP 192:sxZMRuWH/fas7gIdpxel4IHW6+WNOWmgpFaQ/YYBH+8qxIg5AJ:sxZMnH/fas7h+Hbr7l/fA+
TLSH
T1C032A852AD24E97B8CCBE219BA55BB13E6F9517261D01E48EAFC861C04E67DD330740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90d17db4-18c8-4ce6-8750-d78d7678b0d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\90d17db4-18c8-4ce6-8750-d78d7678b0d0.tmp
Size 10KB
SHA256 90fc506a9182cf7892d74a3c1f6a5aa992f78b30c3c5be515d6f0e5261be34af
MD5 4d626accb9c4a73d528731ad07e1bc49
SHA1 fbf00863167ce66400310bc06fc04d8c48676b15
SHA512 84f8977ed5e57b19f2dbe86c2d31a12994c3f2ac259b1a65dd4fb8386316d835717da84be1bdfe425c568b125bb4a7c51ea9b1c12645018ccf61f68f5fbb868e
SSDEEP 192:sxZMR3WH/faspgIdpxUIHW6+WNOTI/YYB02qxIgrJ:sxZMEH/fasph/Hbp/fG9
TLSH
T1DF22B952AE24E97B8CCBE319BA55BB13E6F9513261D01E48AAFC861C04E67DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ca6632e-81bf-4f91-b97f-29ee7b1bbed9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9ca6632e-81bf-4f91-b97f-29ee7b1bbed9.tmp
Size 10KB
SHA256 991e92eb0eca296779974b9a07bd9629935715a115cf14867f48805a7c795461
MD5 2493a6bb26a4a5917ab12cb8f2c61abf
SHA1 19ec9fe30e8b0ab569277226a2cb1fd2bb818bec
SHA512 d11c6b09675831594c217669d01afe243aa230cc447d3653c2297dd7b98c0660c260e592978f63d1adcee3c0daf9a73394770a34586d6eb988552bcb0a4cf1ef
SSDEEP 192:sxZMR3WH/fasygIdpxel4IHW6+WNOWmgXYYB1G2qxIg5yJ:sxZMEH/fasyh+Hbr7Xf1os
TLSH
T16432A752AE24E97B8CCBE219BA55BB13D6F9513261D01E48EAFC961C04E67DD330740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 7cbd5719420065feebe9ebf2e87da4f2a3c4b4412923540c47464070415754da
MD5 acb7a23ed1ac056966767703ac99ab81
SHA1 da57cdd2a18f461640caf07b1e7f92b9680ae13b
SHA512 05fa0d59ed7389f2ed1d76cc40eca9b21f6b1b53e4388d84caa3d4562ce78fe8f7100e71e19aec88e257f8186eb760f4eb1874b52ea46b9284da5bbf29533294
TLSH
T12AE026C844CCC22FE3486847017CB38D8381271AD3C0AA9E2708CD847207044B6CAAA4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 24e9fe1ee9f84fcafb9788e86d8182b0860bd542b01db369a56e45a2606197b6
MD5 4d676aeb9a1eec6b2dfe757a81976070
SHA1 56f4f7fca220d9e8ebed86d3b3f0cf6f1d256dc9
SHA512 42131eac59a1386d1f8d355e60775536ef5d5af0f566968d8eae3b03cd080e13248e6f17365b380c04288a733c7b119dbe00a3846770bf9595d22cdb7437e557
TLSH
T178419502CE5064AAFFA0867EC8D05D8737719D816D83CE0703A7C5BDAE7AFB25604248
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 b9f667add2b07a72946b86b6480b383aec4813af4a603789ad79aef4b6c027f8
MD5 3965eb47bee35d8861186174cd5056ba
SHA1 54b8ad098027663ad7ae5df8db1d2d74e871a92c
SHA512 e65f46ce62f490cc5e2778570b0d392570db6508a64de555997f7dad4dbc52eb290fefcf3f3befcee2c1379d7f323d8468d633240de0685c28fa577340646546
TLSH
T1EE418602CE5074AAFFA4867E88D01D8737719D916DC3CE1703A7C5BDAE7AFB24600248
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f7e5c43487bf6502778393ce330b80f645fb0036fd136ace318de9f1a2e6fcd6
MD5 8013a1531b68e592c961ec80b63a899a
SHA1 88695e42f32e82e7f99b583f05e8d87d63d089d0
SHA512 dab7190df21c7bc7db94fe48827a1334515cab7cb4d1fb19321ef29dd2910c2566e6f5e089c151c3736aaeac0cc9476dee02643ddfa4ec664f980332481e91a0
TLSH
T1F5413142CA5128A6FF9485BDC9D41E8B3B719C91ADC3CE1703A7C4BDEE76F724604258
MD5 SHA1 SHA512 TLSH

Submit Download

ed4f27a3-ca94-4a8c-a5af-cc57b3a5bc74.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ed4f27a3-ca94-4a8c-a5af-cc57b3a5bc74.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1c225f08-6de6-40d3-9e30-716c80ed98ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1c225f08-6de6-40d3-9e30-716c80ed98ad.tmp
Size 3KB
SHA256 e48c0f4f47de99336174eaee34146dea68c0f717bd56962a80f3a103cd6dd914
MD5 0548a4f53169a2e3c46f7d365338de35
SHA1 dc0dfa65b98f968b546397cfed9c0ba219b80411
SHA512 ea21b6c5fe50a98998a2ab9a9cd9ea565767442cebe5f79b65d4436f5313eef89b501109896bdd1cd58e049ee36906de8240f7fb0526b0b71b250043da62d7a9
TLSH
T13D81AEF7C3E4862ED90652F0AA287E1FCE1D1919436C3C2AC8D5DE5BA3E2471E101A5F
MD5 SHA1 SHA512 TLSH

Submit Download

f8d966e9-6b20-4189-982b-bb8886faeb59.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f8d966e9-6b20-4189-982b-bb8886faeb59.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

fed22e59-cd06-4f53-952d-86c62ef3a385.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fed22e59-cd06-4f53-952d-86c62ef3a385.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\534ac8fa811925c74cff4ded87750e6a894fbecf\1a94dcdc-40cd-41eb-92b4-c7bd47e724f9\index-dir\temp-index
Size 72B
SHA256 d4881f240e8d49f7fc4ccbe2df2fbc6dbb6c07474242be2642a483f282fb39ea
MD5 af0931e585a30f1bb8b2e9e8d6bf9d81
SHA1 7ce7c9a7bea56191051ee13a074c1d5cfe56b704
SHA512 3b060fc97793f960d9e37c533ee6332e13d616f2b10a3295a7fb231863c377f54677584d160ae6345118be4f9d56c0dc54073786addf5b16a3d457aafc9bfa65
TLSH
T109A002A9018581F6FC626BF21456C749325A5D1809912205D8996255AC593414113405
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\534ac8fa811925c74cff4ded87750e6a894fbecf\1a94dcdc-40cd-41eb-92b4-c7bd47e724f9\index-dir\the-real-index
Size 48B
SHA256 150739f9163b303f00cc92b43820cb794c6057b74960ee78593523e964b0f776
MD5 78a3abd29983c1d8b57e919fe5c36412
SHA1 02962c134b4c8f46ba2d54d23037ca7939a9def0
SHA512 b10067c2a3e80fee476f94cf5a25bb84941efce10b46624cfc7fef51ffc64dd9a301290a706d36bad5638db95d7acd5e8f0f4ea25573a7421a404b3d4ed5ffc6
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\534ac8fa811925c74cff4ded87750e6a894fbecf\index.txt
Size 155B
SHA256 65a631ff6b7f7f9faaf626013c80032c0987ca7f35b476a422ebc5d3889d040b
MD5 9986bda09a9e06deac4f1b7093093b10
SHA1 da196ae845d188f9991e1564e2e3ef2a9b9f41e5
SHA512 4ac3fb85590dad3369b31560fd7b2c908929eed0cf6647e253e4f21fdc637bdeab436d2e11b17539487da20765514ec97bb0779b6dc8b4c344b0195ac76cbbc5
TLSH
T14DC08CF38325274AF32620D38707D600EE278E4F48829128021AA30CAA30196C7CA335
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\534ac8fa811925c74cff4ded87750e6a894fbecf\index.txt.tmp
Size 149B
SHA256 aa461931597d42324d568e431bd1319aa1570c7dd622b87e31a47625b6dd4fa4
MD5 ffb9b30c49b246cceb4a928afc99a037
SHA1 9f2d4060ff78d56f3aa345219754b40a52b966cc
SHA512 b6c741fde0f924b2f55848d6e661a5a6217b07d8df49d5945a3249f5ece96271e04d2e0be1b191ef85933a21cb4ab45fc7bf95a4628abc9f29cdf22df4273cf0
TLSH
T110C08CF383256742F22262D28607D600EE278B4F04829128012A820C99101D583CB335
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 d4023788a0d0c474e32c6b919ade43e29080157d9661e974db479d5993c5b587
MD5 b903f7f454b806b752c34050d0e7bd3b
SHA1 861d7c26d47fde0e13b61f55ffa5c615a93f0a4b
SHA512 e3ed2c1fd9fcc2b0b883f8ad710863434aa2fd5ad963bbaf8fe3ee3d47092fd195540299e60be027f1e2f1decc9a86d495539ef124e61751d852cefb5214b7f5
TLSH
T103A002505957510FC1F212B02D46155E3AF0EF918B0E6341D0F46375CA587414185004
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 aa13ed53a30efe7d9d3fca22b8ad577d0b61b6253b2b9be6d31e913675b6f057
MD5 3c42ce3a9ed422342a9a45bd2c86eb75
SHA1 a8d772c0d0b7bd4f884ee494a0edc277edb805ee
SHA512 0f35430fb116d09d70d0157f26fd412a26034f21db1ec5a4d2b79ed46583071f61d1069e0f13c1d84cb3c76a4e3f27588d40d557e70ad0a700bae4e0ea354f84
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9816e679368323add31fc49fb06ed08e2c76a868d0c741eac283366a6eabfc74
MD5 af024959fe43b0bd72254ddef4e780ad
SHA1 19b06ff106b8401e41b1376fb3df4eb32510b04e
SHA512 4901e46a66100d0c8df68a946a02fc246236e681f7f414b465965201cfd81e9d00817155093a228e93fc8e21c6c6a63d8766e3f5018e6bf20b7f0cf4aecedd34
SSDEEP 48:KgjGnDtFVWbFIdISDWK9z1hWxrGYQxjHyLxgNBLPTsbfq3ISZsK95TKIfK3KM/yK:KoUYKxayaSwKrTKQK3Kuq0t
TLSH
T19B917744327F0300397E298951658A1B664230BE316CE67F7FB941A24E2FE046DFE9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8541722-fcdd-453f-bfd9-69b26c5e96db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b8541722-fcdd-453f-bfd9-69b26c5e96db.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eba1e117-a5fa-4578-bab9-73ab17f38ce1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eba1e117-a5fa-4578-bab9-73ab17f38ce1.tmp
Size 27KB
SHA256 072b9d08de484273668f322f484919ebe9262e1b1aad63a5e6f8e5f6e39c9426
MD5 402e6668eb96315cc7260549d9477726
SHA1 b5fe9e163c4e1ed6e61eb695f0334a0507e45a8d
SHA512 ae26e4820475a6f489b0afd778d601f9bb29564b1932844a2d5a5a479d8454b98379ba918149a7c7279b767236d9672f38509f0d9034b0e8007a2383e46007c0
SSDEEP 768:yfyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXZrop+jax:yfyYR7jWv3NpBu1ja/CL8OXSrx
TLSH
T1C7C2E92B640DCB7E4FC01A9DDC5A6F977E9802C7A6548D4047FA944C02C77EEA12A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

51adb2da-55d8-48d2-b7da-4abb6073f08f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\51adb2da-55d8-48d2-b7da-4abb6073f08f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f6719349657a11db9fa3391ccc8313c0c059fba8908596d1e96e00335a3b556a
MD5 ff1560b9c4d81e8bde519b62396a1640
SHA1 4bddf45b66e636deb34bc81cfa5fce8ad61b0ce2
SHA512 325fa3717f61f893fc9370ed6b9fd5fcb2cb62358810b1583dfa074deb182140ad59a5024d52337806a8f58d222651056a9700b35cf98cab13d8dca80ca4687e
MD5 SHA1 SHA512

Submit Download

751f76de-596e-4b97-b1ad-3cfcf9dd4ad5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\751f76de-596e-4b97-b1ad-3cfcf9dd4ad5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4a00ca218263f9a935e8881ceb5146a1c319e01ba164a19ee059ddc2f8cdcc80
MD5 ba1cf33f343f82d21ad63b2510109e7f
SHA1 21bae1a51f045227087e24188830eaa34994f8a3
SHA512 54a588b8b160c845dec0d0cca6b367f76552f0f79c28f7ea7e51273c0e05e6144ade500a4193af2b155271e499cd0d9381308bee2ebb118ebf374032dcd75577
TLSH
T16A410558B6F91108B3B77F169BF6A8AD487F79732F06D56D00110D4F0A22B40C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download