hxxps://www[.]google[.]com/maps/place/%D0%9E%D1%81%D0%BC%D0%B0%D0%BD%D0%B0+%D0%82%D0%B8%D0%BA%D0%B8%D1%9B%D0%B0+4,+%D0%91%D0%B5%D0%BE%D0%B3%D1%80%D0%B0%D0%B4/@44[.]8167229,20[.]4799238,17z/data=%213m1%214b1%214m6%213m5%211s0x475a7abe8d50955d[:]0xfd3e61557c228130%218m2%213d44[.]8167229%214d20[.]4799238%2116s/g/11fx0q7v18

Analysis

user interaction
yes
max time kernel
46s
max time network
45s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 05:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.google.com/maps/place/%D0%9E%D1%81%D0%BC%D0%B0%D0%BD%D0%B0+%D0%82%D0%B8%D0%BA%D0%B8%D1%9B%D0%B0+4,+%D0%91%D0%B5%D0%BE%D0%B3%D1%80%D0%B0%D0%B4/@44.8167229,20.4799238,17z/data=%213m1%214b1%214m6%213m5%211s0x475a7abe8d50955d:0xfd3e61557c228130%218m2%213d44.8167229%214d20.4799238%2116s/g/11fx0q7v18
Sample260801-gn38vaef76

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
664	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300374852109823"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{6F26B5CE-692F-455A-84BA-7A8582E39FDA}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{A318D0C0-E32D-4926-935E-51A44BBCFC48}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 1236	4640	msedge.exe	85
PID 4640 wrote to memory of 664	4640	msedge.exe	86
PID 4640 wrote to memory of 3744	4640	msedge.exe	87
PID 4640 wrote to memory of 3744	4640	msedge.exe	87
PID 4640 wrote to memory of 3744	4640	msedge.exe	87
PID 4640 wrote to memory of 3848	4640	msedge.exe	89
PID 4640 wrote to memory of 3848	4640	msedge.exe	89
PID 4640 wrote to memory of 4760	4640	msedge.exe	90
PID 4640 wrote to memory of 3272	4640	msedge.exe	91
PID 4640 wrote to memory of 4760	4640	msedge.exe	90
PID 4640 wrote to memory of 4760	4640	msedge.exe	90
PID 4640 wrote to memory of 3272	4640	msedge.exe	91
PID 4640 wrote to memory of 3272	4640	msedge.exe	91
PID 4640 wrote to memory of 2088	4640	msedge.exe	92
PID 4640 wrote to memory of 2088	4640	msedge.exe	92
PID 4640 wrote to memory of 2088	4640	msedge.exe	92
PID 4640 wrote to memory of 4284	4640	msedge.exe	93
PID 4640 wrote to memory of 4284	4640	msedge.exe	93
PID 4640 wrote to memory of 4284	4640	msedge.exe	93
PID 4640 wrote to memory of 4576	4640	msedge.exe	96
PID 4640 wrote to memory of 4576	4640	msedge.exe	96
PID 4640 wrote to memory of 4576	4640	msedge.exe	96
PID 4640 wrote to memory of 3012	4640	msedge.exe	98
PID 4640 wrote to memory of 3012	4640	msedge.exe	98
PID 4640 wrote to memory of 3580	4640	msedge.exe	99
PID 4640 wrote to memory of 3580	4640	msedge.exe	99
PID 4640 wrote to memory of 2876	4640	msedge.exe	101
PID 4640 wrote to memory of 2456	4640	msedge.exe	109
PID 4640 wrote to memory of 4016	4640	msedge.exe	110
PID 4640 wrote to memory of 2456	4640	msedge.exe	109
PID 4640 wrote to memory of 5256	4640	msedge.exe	120
PID 4640 wrote to memory of 5264	4640	msedge.exe	121
PID 4640 wrote to memory of 5272	4640	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.google.com/maps/place/%D0%9E%D1%81%D0%BC%D0%B0%D0%BD%D0%B0+%D0%82%D0%B8%D0%BA%D0%B8%D1%9B%D0%B0+4,+%D0%91%D0%B5%D0%BE%D0%B3%D1%80%D0%B0%D0%B4/@44.8167229,20.4799238,17z/data=%213m1%214b1%214m6%213m5%211s0x475a7abe8d50955d:0xfd3e61557c228130%218m2%213d44.8167229%214d20.4799238%2116s/g/11fx0q7v18
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2bc,0x7ff8e9d2c188,0x7ff8e9d2c194,0x7ff8e9d2c1a0
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,2146511131912405889,2012681111780742560,524288 --field-trial-handle=2264,i,17323497159049072798,16180332133097138219,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - System Time Discovery
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,6330683226966918665,9842442440187655120,262144 --field-trial-handle=2264,i,17323497159049072798,16180332133097138219,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,11605267933780130160,664762136433631909,524288 --field-trial-handle=2264,i,17323497159049072798,16180332133097138219,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,13257882835160190996,14865169609389466202,2097152 --field-trial-handle=2264,i,17323497159049072798,16180332133097138219,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,6334281493002817167,9562141073146672246,2097152 --field-trial-handle=2264,i,17323497159049072798,16180332133097138219,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,13257146651792881123,555599173132735619,2097152 --field-trial-handle=2264,i,17323497159049072798,16180332133097138219,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,3510317079374215222,11604747673475866993,2097152 --field-trial-handle=2264,i,17323497159049072798,16180332133097138219,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:2
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3496,i,7285081119075247143,7332003216051239418,2097152 --field-trial-handle=2264,i,17323497159049072798,16180332133097138219,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,9776883738516816091,6000227911218251713,524288 --field-trial-handle=2264,i,17323497159049072798,16180332133097138219,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,14093602357766612124,1629204605517579351,524288 --field-trial-handle=2264,i,17323497159049072798,16180332133097138219,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,4755078361167556159,3027552804821749066,524288 --field-trial-handle=2264,i,17323497159049072798,16180332133097138219,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,4755078361167556159,3027552804821749066,524288 --field-trial-handle=2264,i,17323497159049072798,16180332133097138219,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,16037158907397238299,17184816141518084564,524288 --field-trial-handle=2264,i,17323497159049072798,16180332133097138219,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,17794429881121029190,12366376417008068339,524288 --field-trial-handle=2264,i,17323497159049072798,16180332133097138219,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,2492322924462927445,15257180155378248049,524288 --field-trial-handle=2264,i,17323497159049072798,16180332133097138219,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,4898720899371940653,11714141660764513598,524288 --field-trial-handle=2264,i,17323497159049072798,16180332133097138219,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=784,i,10481100607617107685,10919903549832578433,524288 --field-trial-handle=2264,i,17323497159049072798,16180332133097138219,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:5272

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 474c5d91e4588c8e99ba482344201af37302de0237c5e1c40585ae75d0eca77e
MD5 58897b3bddd7e8e00800786dcf6408cb
SHA1 573f0bb70d426f8e710af95011cf6c389d5de615
SHA512 1c991052236963c6724e14f3cf4d1abd53afdebaf26c2998c8553470b18d3506505d1725f1aef1526f89128b336eba3f66d1bb6d7bd73b9d908356a916e9a751
SSDEEP 192:sxZ0RpyM/jK1Ml8Mk2/fosiJMoIdpehGOKuHW6+WNCtZm/Y9IxCORyIgrJ:sxZ0fM2/fosiJA0pHbL/Y19
TLSH
T1D752C5126A34697BCCEBD209B945BB63D6F5153292940E58AAFCD91C00E7BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4c42a46f02efe58f433b756cf520a03d6d80f8ee1d6c4c093e1501a19e79042c
MD5 aadcf565d7718c3f38189231ff537b11
SHA1 391d554c04e71bbaead439e88b17247b1a4874f5
SHA512 8d3c36ba09ecfce7496dda06639308320ab55b6d344f510e8c2b277935cffb59ecca0a5c0f57dc9028476d185619899502b737d60b292d558baf5a8911b7dab0
SSDEEP 768:Bacv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWN2roNg6z:Bacv21wWvu+Z+u1jaeFLeRNNNj
TLSH
T12DD20B2B280CCB7E4F845E9CED2A6F866ED801CB57988D5447FA884C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\28da9c56fde4021055a681112c092453f74d8dd8\d69439ef-bd14-43b0-9150-9c8aa2eadc9e\index-dir\the-real-index
Size 72B
SHA256 b16a9e553a91de595ff5edead390ec644b3beddc53ceaaaa0bf9e22731427b7a
MD5 4ab870efc98d76f1db82b2df48cdef07
SHA1 898141dc21078a07341b474dd5f75d335e402bbf
SHA512 3e78b145ffb032138c8485075204e57c7ad515644fd0375c5322bc1456e9928523c7df28456c79ad168b08839975af31d0b6f68561ed8b0e71af27f3ff0be0c8
TLSH
T161A0027743600021C98C62741462AA803311492052820206449811958C756AD4571834
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58eb45.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\28da9c56fde4021055a681112c092453f74d8dd8\d69439ef-bd14-43b0-9150-9c8aa2eadc9e\index-dir\the-real-index~RFe58eb45.TMP
Size 48B
SHA256 e653b0f111f0265335e706e7dde861499a1fd3f7bd8dc480cbc9312773843c18
MD5 038ce625178dac0926dbae13f608837b
SHA1 36d93c5dc4f7bb6d7ec9c178d9915780430fdb79
SHA512 71bf78a21e9c7c02609c82e81a6ecd1d9d2f14a00b85d742d91526bc84cd4cadf240f5e5e16bcf1fa1199352da7bb95e4a0a47a17171d45bed52d53d167bc675
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\28da9c56fde4021055a681112c092453f74d8dd8\index.txt
Size 135B
SHA256 5691d995021a465e5b45e090a7cda06410baa9107438eebc8c57cb75957ec0b4
MD5 da968f3fc25abfbc5e621a797d3e91c9
SHA1 1d78b5c332bfd44ceba307b2a2916feb517ad58b
SHA512 dd5369b22daec1cab8b88bdc72c1315273042097a8e2ddcd8296f037636b3534abd292770a123f61e6d27572e5d3d45e6693a117df17fef55ee985f554f3f9b0
TLSH
T1ACC092F7A519B4062E81D3E13A30662D9A261AC5C8ACEDD6E01455D28BDA8B30493AF2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58eb74.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\28da9c56fde4021055a681112c092453f74d8dd8\index.txt~RFe58eb74.TMP
Size 141B
SHA256 e40c8c729be868f2d895c5f074829e04faa668a187ca9f216379ca1d163f10d5
MD5 49cce89dc636c58b0570f207c83353e2
SHA1 2242e79168f2f406baa27e29baf44db01d6d5f8b
SHA512 fe25cfce2978ccdfc741242a60c5b102b116850a939225cfe10233e66a11b259858f367ab62dfccb904a7acbf835fd700e1219fa4accf7eadcd76ccf0b468c3f
TLSH
T16CC02BF3900070022F80D2D13930210D89268DC1CC4CEDC5F00030C247F547300828F1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 27f9982122388eecbf827bff0ff804d8cb9739a41fd2ba15566f99b8dee80688
MD5 4395e7683b413bad3e7d58442c62150b
SHA1 bb91d446f72934f0dff1ce9a051d10431d9cc351
SHA512 4c2b3245e4ffede0e7d48d10d20f2c8e1ab244a012e20db66e1e147020997700ed923d1b30874124c916053e4195572704c9cd138f3b7bb68c06ec671af4d675
TLSH
T136B00221456E50CBC9482771E5CD12C8B3304D554F03562254F4E5F8CC9B75AA157A0A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58eaf7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58eaf7.TMP
Size 48B
SHA256 a68e89706e8a8f4e973eb8d6cbf453b7624f086715a1970717a6aa468e1481d4
MD5 ed68588a3e7462b3670a1da43f3985b0
SHA1 91c7ad638d2b591529ac02f3c24f769e497120e9
SHA512 68dfcfda45397fdde922a7bbaf71b24ee7da69bfba04fe3935139ddf11cb688bf4b85b9b08c7cbaa5a2bdb11a585967b46a81918820d795e9b14823833ac8e53
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d9cbe900333748af7f81c5c745466c7b6b171af5f6737316a00cad9d9e99d54a
MD5 cbfe21404b5e617b34f4ee88abeb79c9
SHA1 c792e6b24bd0865504ec782179e9beb36b183033
SHA512 054d0c651ee7a098a18161154d58862b9a7ca139ced2acf1ff8bcf7625564462d611b59ab19e5f095f408e8fd64d5ee6248a9f3132480224a8a48fdceecd1b7e
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDWul+K+MiOD+K8gj:mT+9Vw
TLSH
T15C915201747E02812D3F7A1CE265A92B1A4275A33519B87FBFF900A24E6BE511CFDCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f92ac09721cbc9c00cde0d02692bb4be77bfbfcdfdbbe4adef67dec8ff8ba517
MD5 7d9d6616aefa8295aeb93cec561b58b8
SHA1 3339629da2868a0bcd48819ea32f116184ff76f9
SHA512 00a88d2076dfd6a149733a2d3d4576f665581c120883e4e343bbdabf5d365278a7b30218d774d7db2b9a6df9941f0eabc0f0e83d5b50e89b9a765e22923fcb93
SSDEEP 384:fZcIhsNFRxcziWTde+CBd0esJBnTKwBODNZOCR0V:3hPT8JxsJBnewBKZOM0V
TLSH
T1E5927C719C385CBB8EE6A105F84B35174FF89173E6D53B94D5EDBB1C01EA698130AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ac4922ed8435e47a5c2cfc36d8762666d23ef347ed55ae557bca0fd5e598f514
MD5 d8cfc88e4244974e16a021ce4a81aac2
SHA1 b1c0d7ff247f26b947416392eb808495063cc1ab
SHA512 50e667e174e760e78c6307c9fc16c19e09abaa946642e9c1e71207a9618c9d63c6f5259d7013966494684075769d949a18db65e09caf88cd651168aae9b51b19
SSDEEP 192:JONa6v+YLNQmiUyQFZh+CGD+FdeP9ospusP2AU6:JONa6vz/HZh+CBd0esJOAU6
TLSH
T19402EA35AD381C7B9FF2AE45F4873A275FA81177E9912F84D9E81F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 cf92758b18276a74ee7eaf00beed60b494584179d5e405e81dff75e84ef01088
MD5 b6d671151facb71a265e31015d35b659
SHA1 913dd38bd1754ebe4e6098401c256a5ae88076ae
SHA512 6c3a0a14e8b0e3869401af12fb6af62ad5dd9dcce6a0bc3950dff2c2faeb2b2695e1359323aecd6f9da85538fe68287619af1518ca0f8b2eb2885e5cc5534d94
SSDEEP 384:WZcIhsNF2xcziWTde+CBd0esJBnTKwBODNZOCR0V:EhmT8JxsJBnewBKZOM0V
TLSH
T12B926C719C385CBB8EE6A105F84B35174FF89173E6D52BA4D5EDBB1C01EA698130AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7939bc6f5ca91501616685cf530795888f0840a492df9f7f0e2ec5979504ec34
MD5 2b9db4005357ba93cc61979071b38d09
SHA1 9176152edeed5955fb74499b793a04e268d5e6ba
SHA512 41f97354f2a4a829413f7723d07f86cfff1a18452450a5acd51fef0070a1d1c3f35cd258f786549b11b8e3991f89d822c7c1819a75794a50233b2139d2565eda
SSDEEP 192:CONw6v+YLXQmiUyeF/h+CGD+FdeP9osNOeBbCHuqtU6:CONw6vzlH/h+CBd0es6BU6
TLSH
T1E4120935A8786C6B5EE3A545F48735135FA45137EAC63F90E5EC2F1C01EF6AC2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20c3d4f6-5a1d-4427-9121-e2734afc90f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\20c3d4f6-5a1d-4427-9121-e2734afc90f5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d9cf234eb49efbb5447f45d62e6ee072435cee8fc3c3fc09800c791c2e031749
MD5 b4224d85ee17224011e16248d205e730
SHA1 51e1d7dcad5288f0074f201ae31124b0b5fef8a8
SHA512 a32aafbef3371fe65502cb742b9088807446664cf8dc4989aeec18b8732d034547b45ee9081eea78628060943b624ad19e75363180cb4b90dee4003459ed976d
TLSH
T11D411A8CB6E92108B3B76F5A9BF6A46E497A7C772E07D05E10110E4F0A72B40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads