hxxps://drive[.]google[.]com/drive/folders/1uXUNCvFkq9qQWDudW67tsKxz9DL8xkGp

Analysis

user interaction
yes
max time kernel
118s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://drive.google.com/drive/folders/1uXUNCvFkq9qQWDudW67tsKxz9DL8xkGp
Sample260813-rnalmsaq21

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
24	drive.google.com
47	drive.google.com
9	drive.google.com
10	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4808	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311044070314875"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{FB76385B-0A69-46A7-9FEB-2E8718D19E6B}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 3784	3448	msedge.exe	86
PID 3448 wrote to memory of 4808	3448	msedge.exe	87
PID 3448 wrote to memory of 60	3448	msedge.exe	88
PID 3448 wrote to memory of 60	3448	msedge.exe	88
PID 3448 wrote to memory of 60	3448	msedge.exe	88
PID 3448 wrote to memory of 4200	3448	msedge.exe	89
PID 3448 wrote to memory of 4200	3448	msedge.exe	89
PID 3448 wrote to memory of 1004	3448	msedge.exe	91
PID 3448 wrote to memory of 1480	3448	msedge.exe	92
PID 3448 wrote to memory of 1004	3448	msedge.exe	91
PID 3448 wrote to memory of 1004	3448	msedge.exe	91
PID 3448 wrote to memory of 1480	3448	msedge.exe	92
PID 3448 wrote to memory of 1480	3448	msedge.exe	92
PID 3448 wrote to memory of 2136	3448	msedge.exe	93
PID 3448 wrote to memory of 2136	3448	msedge.exe	93
PID 3448 wrote to memory of 1320	3448	msedge.exe	94
PID 3448 wrote to memory of 2136	3448	msedge.exe	93
PID 3448 wrote to memory of 1320	3448	msedge.exe	94
PID 3448 wrote to memory of 1320	3448	msedge.exe	94
PID 3448 wrote to memory of 3296	3448	msedge.exe	98
PID 3448 wrote to memory of 3296	3448	msedge.exe	98
PID 3448 wrote to memory of 3296	3448	msedge.exe	98
PID 3448 wrote to memory of 2448	3448	msedge.exe	99
PID 3448 wrote to memory of 4740	3448	msedge.exe	100
PID 3448 wrote to memory of 2448	3448	msedge.exe	99
PID 3448 wrote to memory of 4740	3448	msedge.exe	100
PID 3448 wrote to memory of 4468	3448	msedge.exe	102
PID 3448 wrote to memory of 4944	3448	msedge.exe	108
PID 3448 wrote to memory of 2616	3448	msedge.exe	109
PID 3448 wrote to memory of 1636	3448	msedge.exe	110
PID 3448 wrote to memory of 4016	3448	msedge.exe	115
PID 3448 wrote to memory of 4016	3448	msedge.exe	115
PID 3448 wrote to memory of 2660	3448	msedge.exe	116
PID 3448 wrote to memory of 2660	3448	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/drive/folders/1uXUNCvFkq9qQWDudW67tsKxz9DL8xkGp
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x290,0x7ff9e8d6c188,0x7ff9e8d6c194,0x7ff9e8d6c1a0
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,14323871019811781535,18245063843644727028,524288 --field-trial-handle=2356,i,6150062762958777867,7009335921530884045,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,18213922063055259731,5335924571497174784,262144 --field-trial-handle=2356,i,6150062762958777867,7009335921530884045,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,6886884899595392026,18323799417140163535,524288 --field-trial-handle=2356,i,6150062762958777867,7009335921530884045,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,4989309057927550894,6360917728913074442,2097152 --field-trial-handle=2356,i,6150062762958777867,7009335921530884045,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,6679487309552866969,9977813462649808720,2097152 --field-trial-handle=2356,i,6150062762958777867,7009335921530884045,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,10512668657265933827,2757931088287998114,2097152 --field-trial-handle=2356,i,6150062762958777867,7009335921530884045,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,4023978306663170062,16752296065393505932,2097152 --field-trial-handle=2356,i,6150062762958777867,7009335921530884045,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3776,i,11235306554459616033,726568320512987551,2097152 --field-trial-handle=2356,i,6150062762958777867,7009335921530884045,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,12389550879832080031,2144664666345664649,524288 --field-trial-handle=2356,i,6150062762958777867,7009335921530884045,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,4477139833892445191,15120968973372447787,524288 --field-trial-handle=2356,i,6150062762958777867,7009335921530884045,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,8993914959484941220,5980665321890176645,524288 --field-trial-handle=2356,i,6150062762958777867,7009335921530884045,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,8993914959484941220,5980665321890176645,524288 --field-trial-handle=2356,i,6150062762958777867,7009335921530884045,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,10575270499447813019,11045897617087289694,524288 --field-trial-handle=2356,i,6150062762958777867,7009335921530884045,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,7271890347173317973,7506043280786257268,524288 --field-trial-handle=2356,i,6150062762958777867,7009335921530884045,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1668,i,10738499621210972449,111415306195497164,524288 --field-trial-handle=2356,i,6150062762958777867,7009335921530884045,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,10310807544980462115,7140272795420344891,524288 --field-trial-handle=2356,i,6150062762958777867,7009335921530884045,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,15509447265189097719,9017267540944653012,524288 --field-trial-handle=2356,i,6150062762958777867,7009335921530884045,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:2660

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 dd93834da96bc48df415033553eedf80bf463830fefe71342451e6e1b32c7df4
MD5 4c06f574572eee1673951f747ca76821
SHA1 df69bd0102f053e4561f41f282f3f7737318c3e2
SHA512 c1877b6b3b78a0b4cfbfb13ce0642e895f7d5d2c05e2baa9946f294b3c71b3059f0ab80b410a2b047739a8cd8e0e70440e81f617957ffac4b11ed7e9d358fed4
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
TLSH
T1C3B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 335KB
SHA256 510937c81cb1a502119ab143419709b78c971a487406b87287e5d0e818995e9a
MD5 9f9c9ac1a584487d0961c6af2cac057c
SHA1 dbe3f8ded8c2390dbf7263da9aae9c7dda1cd828
SHA512 5fd4adbc586cd8110325eac005eb71792205e8e0f0132971d0758747baa058290e23daa9d1fa4574982f227c4ef0f3eae2055873bdb293fd404cc753bec05421
SSDEEP 6144:1EYK/wn749QJWZHyBE3FQ8Buo3Faz9J0ze/79bZJQ6PXmMo9uLUz:1EYK/wn70h5sE3F4oVaRmzWJT3obz
TLSH
T1F6742325C2DDFB139B531A01147E5975C638E876E4C01FB28B3CE026AF26E2D1468DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 c59ec26d003462fb0492e9737106bf8d2de35a9f3541b676d059941cb0a88b50
MD5 5bdfaca2c44917339e4a3c215123ef54
SHA1 7cd5426ced64decdcec0e6a99e7ff2ba34a943a0
SHA512 002f13170375b85ef4e889246858791dc11aceaf1ab33459e4ff6b5b92ffcb4e07d4d782ab0a47becf51fd02cc1c80b28bf4d8c5560177c8a1f9e0ff615bb45c
SSDEEP 96:k2Nf5KKzcrFEi+8JbB9N8ioKwZkcTR9Pco:r55HzAdvb4Z3DPT
TLSH
T19DA1E9058982A59FC7113A31DCEA3E58317096F95F4ADD123F38ACBD6E197F289D08C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58ff6a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ff6a.TMP
Size 3KB
SHA256 7fde6229cf14ec81efd7cc9467da39aa2aefb397e3ef4c93aae326c3c7a0159c
MD5 5c48ffc3bb3e9189245039e7cfb7bc3f
SHA1 ea3d2d9482bac11a49b0335357b54939c40ba019
SHA512 e3dd2eba1539d48bdacc5bd52481557f7c11187ae7f8195ca791a63e9f702dc14a15091b97a302cf5147709389412ecb5954c8cc97d380afed6d213f212248d5
TLSH
T1FF711A584A964A9DD3503230EDEE1F5A71718BC41F9B8E023F7488BCA5257F789E28E4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 3470184304a33605315f084be627b79c80e6d96776f8b13200c7f44d0753dac7
MD5 664cb7d2add17a815c03c342a12f29c8
SHA1 9b5f21271c24aa267ac31517eef3af80634c6267
SHA512 9bf1fe0527dcbfd22414425252f9d583affea1a8c7960abb32ce388c916b9a55db9b852c4be361a231efb5cd1beb5a06d482f12fca8cd278b6acd352a224b7be
SSDEEP 96:DAOqVgKfjct6BxyvzmWBLtw617bG0LhWZwX9:DbqVgKfjct6BxyvSWBLtw617bGWhWZe9
TLSH
T137D18AB7C7D9C52DC85116F49B11AF1FCE1E061843183C26C8D9BE5BA3E2831E21639E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a9611ed8772dcc68d4216609ea5e49286f638b4c64c0772db50948b87b3656af
MD5 6bb08726d24def7643b134420d30aafa
SHA1 43876e61574f3c616add34581ace9f99f1af7b50
SHA512 5a8a9cef384bb07f2e499c088debf7d011fce8661da9910665597e0eba0aa1fddc50833d8391594b8b7bcfab3fc4e0b1275f9326a95934452276db4b03874d4e
SSDEEP 192:sxZ9RGyM/jK1Ml8Mkg/fhsxbUIdp7QHW6+WNy86/YLxT6aIgrJ:sxZ9AMg/fhsxbNUHbs/M9
TLSH
T10A52E912AA34A977CCDBD209B945BF53D6F90472A2941E489EFCC91C04E6BED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ed7694c0343af956afec8d000d326fc96fc12ba26f3cb6fc0e01ae5ee5d5aca6
MD5 219d06fd6208fca2bdb3fcb97ff43aef
SHA1 261a33099aa9cdc8df43e931f96d0d041612d707
SHA512 77144743830004b2662a6a9b340904c101c397743eb2d047eea27931c4bc31fa4b1ad7a881d5d7ae183e9cdcba9bc716a692b8aed0a6d0392a10e6e3be77b808
SSDEEP 192:sxZ6RGyM/jK1Ml8Mkg/fhsV3UIdp3cQHW6+WNy86/YLWd6aIg5QJ:sxZ6wMg/fhsV3NpHbs/v6
TLSH
T10552D812AA346977CCDBD209B945BF53D6F5046292941E449EFCCE1C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 aaa6316a627611a6cb0d0bade893d53b0621cda3870e4e950a424a9040b4428e
MD5 ef79598b2d239ff037c4ddbf561160cb
SHA1 b06265aa594822267657f1c873b0f9de65529bc3
SHA512 eba31d232ddcde8747eef7a1367c1ad9aaffb1a3111dd482823529b5aa5985ecfa77a074fb2859ff422c32e633dbac3bac4971870535c48a27db71dedb818443
SSDEEP 768:qUs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJN9ro3j:qUs6pD1WvxzWju1jahILIsN23j
TLSH
T187D2FA3B680CCB7E4F841E5CEC2AAF967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 abf293a7936249894360676a8a28cc2b381159c25ba07351a65b255782b8cfad
MD5 032be516ae63279fecdf6057ca2d6028
SHA1 91877201d59c95fae3da80fa62fd4e256cc98550
SHA512 bd5a48a6d0b132377aa86680806245f8f68115036b5f76c0a34332a6e2b1227a0c035227e4db7987c1ef508735e7d9830da15ef14c98aeb5171657bd5dbbe2a2
SSDEEP 96:KUAAKtePe9OKW06aMgKtS6ioK3K+qKcKD6H:iiRlHWr3U
TLSH
T137E1150231BF0A123D7E6A189255C77B4B92B563301DA42B7BE941714DAAE380DFCDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

963ceab9-4b9d-4c24-a59f-a1a033a601f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\963ceab9-4b9d-4c24-a59f-a1a033a601f3.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 8197e3ecea239f42c940cd6d29c3837a39f2f7544c98f8d22f0cc039ca341e82
MD5 bc56df1545f05259bb97bc227a71d8e6
SHA1 6771081bf1c6b9f4e487e44fddf17a09e265a95b
SHA512 4e95d13c3357405cc64ef982fdc1f25499eb3b3aa0d96e3f2c6a84ca28e0059a5970eb6c6c15d93e59ad59ea5a0536c9fa3f2969c58bac380c15f979ea9f0310
SSDEEP 384:6ZcIhsNkE3EHUwsa9xOsHefdeOOPrXLpe8C/8:4hNl1rOqefdeOi9Pf
TLSH
T197927D31B87C6C776DF2E685FA8626138FB84067F5C52B8496ECDF0D01DA6A81307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c6e7b0170966281c2970afe12d6a4c0320465805a5d25ce1c9d44898a7731234
MD5 651ebd8a4fd2a603aca8d6fe2750a356
SHA1 93e40dea971689e79dc00281cc8f36289f361df6
SHA512 70696be4a4acdc9381f62ea6801d7550e388ead03ae7ce7de134824c6990c8f9d7ff4b48224c6e0bea6008cc3c5712fd0b6c392d0e8cc4ac1caef8528c41df50
SSDEEP 384:0iFiZcIEsNs8TUNTUlIlZ3EHU9sa9xOsHefoeOOPrXLpe8C/8:PFQEJwgY41rOqefoeOi9Pf
TLSH
T141D21AF258EB5876DDAE9B47A77D2E138EBCC063F4856640B798890CCC961BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2e5c9d410623d1025fec3c0a5ff0bf931d3f8bd929edda39a0b2af99eb5e7718
MD5 a6995a76688b21626fdb8472d5945cc9
SHA1 73899093d6d007b0a270e38da7dcfabedbaee5cc
SHA512 db3fe80a0de7c60d6d79b7e1306f25a9db6eaf51b52b5d5286ccfc7b35f836b58da63281c438ed228f26b21e6831b892c12fdec2643c37734be0a94c9440b5c5
SSDEEP 192:qONQ6O7+3hQmiUygcGttb0sO2b/WgGLrU6:qONQ61AGt9xOsIvU6
TLSH
T1BD02E83579286CA78EB2AD45FA8727279FA5107BE9952F40DAE85E0C00D765C2343826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 49d2222e70fbf7c1ba958d7bdc85dbbd0f14e4bc531ccd6da2cea8e910b78a67
MD5 84284aa1a3a721535f82dbb94a240891
SHA1 87533e3f01c076f8952064a052b5b7c20935e26d
SHA512 f72ce909cd1da223491d8747d3ae288576c61daab382f2a8a7723a2581ecbd73ec12fa7ba9b5b0e6571f4055f7fe1c398a29c9a1e3cfdcc4a58aa72f9b80da5d
SSDEEP 192:iON96O7+3+QmiUy2c8ttb0sO2b/H5EfXcNIqbIU6:iON96MU8t9xOsHefEeU6
TLSH
T19E1229367868AC775EE2A485F5C736178F65016BE94A3F80D5EC1E0C00EF6AC234B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 036a2acc6c48877e8a75d8a8dbabd4ec50f23a9a025d8f75efddaa3d48597faf
MD5 7057b5244341ebe43834eb854a9b02b8
SHA1 9b749b87fa4372e328c69beda5ab1f591a2f48fc
SHA512 1b0a0e551a2ddf1120de1bb717b6651fe9eb7902fe83047b752e9437963f26cc4530f141102b6c795febf079c8beb4677725834c811f67990b544a059d4b95bb
SSDEEP 384:bZcIhsNkZ3EHUwsa9xOsHefdeOOPrXLpe8C/8:Dhml1rOqefdeOi9Pf
TLSH
T114927C31B87C6C676DF6E685FA8626138FB84067F5C52B8496ECDF0D01DA6A81307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6efc030d-237d-43dc-b56b-6964d5de222a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6efc030d-237d-43dc-b56b-6964d5de222a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0470dd242d665fa7fe86dbc148c615351d7e50e0628bd4623bf19b96db158e97
MD5 8ea6184cbebd8b3dc636d0aa9fa9fcf6
SHA1 66f0008d036e266d2351a77f66c56de608facb9e
SHA512 1ead00c538978446dc2b2e529ab3de61ef428864f404a9402d883e58c87a1749064e7cae6cee0661216b6a19e8b5bc75299d76048b1feb44c3595ba6a0f32c37
TLSH
T155412A98B6E91108B3B33F1A9BF6A86D897FBD732E06D45E00110E4F0622A40C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads