hxxps://sites[.]google[.]com/view/vedhgffyyou567gbiden68vty67gfo/home

Analysis

user interaction
yes
max time kernel
30s
max time network
31s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 13:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://sites.google.com/view/vedhgffyyou567gbiden68vty67gfo/home
Sample260820-p97gdsde65

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	sites.google.com
4	sites.google.com
11	sites.google.com
50	sites.google.com
81	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3792	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317045801139544"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{F0CD6168-2C79-48E3-A72A-B09DCC48EBC9}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 1016	4968	msedge.exe	85
PID 4968 wrote to memory of 3792	4968	msedge.exe	86
PID 4968 wrote to memory of 1396	4968	msedge.exe	87
PID 4968 wrote to memory of 1396	4968	msedge.exe	87
PID 4968 wrote to memory of 1396	4968	msedge.exe	87
PID 4968 wrote to memory of 2416	4968	msedge.exe	88
PID 4968 wrote to memory of 2416	4968	msedge.exe	88
PID 4968 wrote to memory of 3052	4968	msedge.exe	89
PID 4968 wrote to memory of 3052	4968	msedge.exe	89
PID 4968 wrote to memory of 3052	4968	msedge.exe	89
PID 4968 wrote to memory of 3436	4968	msedge.exe	91
PID 4968 wrote to memory of 3436	4968	msedge.exe	91
PID 4968 wrote to memory of 3436	4968	msedge.exe	91
PID 4968 wrote to memory of 1268	4968	msedge.exe	92
PID 4968 wrote to memory of 1268	4968	msedge.exe	92
PID 4968 wrote to memory of 1268	4968	msedge.exe	92
PID 4968 wrote to memory of 2384	4968	msedge.exe	93
PID 4968 wrote to memory of 2384	4968	msedge.exe	93
PID 4968 wrote to memory of 2384	4968	msedge.exe	93
PID 4968 wrote to memory of 1572	4968	msedge.exe	99
PID 4968 wrote to memory of 3224	4968	msedge.exe	100
PID 4968 wrote to memory of 1572	4968	msedge.exe	99
PID 4968 wrote to memory of 3224	4968	msedge.exe	100
PID 4968 wrote to memory of 964	4968	msedge.exe	102

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sites.google.com/view/vedhgffyyou567gbiden68vty67gfo/home
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x210,0x248,0x7fffe38cc188,0x7fffe38cc194,0x7fffe38cc1a0
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,18361185715405865835,9769838461225638555,524288 --field-trial-handle=2372,i,16629806638066067581,15669190939673806512,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,7217771864233006888,1072622224491826986,262144 --field-trial-handle=2372,i,16629806638066067581,15669190939673806512,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,14605898690653842351,12662455439503854536,524288 --field-trial-handle=2372,i,16629806638066067581,15669190939673806512,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,4947139586808690439,1096973442594498374,2097152 --field-trial-handle=2372,i,16629806638066067581,15669190939673806512,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,9608306270033189562,5414270413040436182,2097152 --field-trial-handle=2372,i,16629806638066067581,15669190939673806512,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,12838685323142956984,1452937842400751111,2097152 --field-trial-handle=2372,i,16629806638066067581,15669190939673806512,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,5022046663193276997,3809383489293907891,2097152 --field-trial-handle=2372,i,16629806638066067581,15669190939673806512,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:2
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,8191079211645355607,6533185132964428603,524288 --field-trial-handle=2372,i,16629806638066067581,15669190939673806512,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,3393897115195310974,10786893956305149961,524288 --field-trial-handle=2372,i,16629806638066067581,15669190939673806512,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,11716477057288892899,12258443954789039252,524288 --field-trial-handle=2372,i,16629806638066067581,15669190939673806512,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,11716477057288892899,12258443954789039252,524288 --field-trial-handle=2372,i,16629806638066067581,15669190939673806512,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:964

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cac55920f8823c4ceaf21e9df262ea5144feec125c060a5abe9067d5317a32d5
MD5 758e232e0cd6d9a81ac6d391eae4c336
SHA1 87b9bddbaf74e9eec5f3f50faec56838c804652d
SHA512 070c7f645a47bcff78d2d6cd584b80ebb96040ad737531962fdbfe7971fda7ba4ce3ef9b1d1ab66f8279fd13535f41075f904d2b233a1a35c9f128131f7dafbb
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7i:fwUQC5VwBIiElEd2K57P7i
TLSH
T16AB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ac43659893b4b97db9a8e2c14d2b5af90a3fa86f220c556b2643c54e0bbcbc78
MD5 4167a1040c91fdd6eb3117aaf02c7155
SHA1 fa43f47e9894aff4832c5681d4462e10ce92cc16
SHA512 1776a48cfec3508cb8236f5f1a1b78dfc6d02c97a2213a1fbac071fc5ddf42193f009aa7abca627cbe6402096bf87b691ec307e49e5cf0f889932599169855a6
TLSH
T16E714C340B126BADFBE51E72E8E147067032C39DDA77FC1DA06096FC6007723A02A117
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d8a8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d8a8.TMP
Size 3KB
SHA256 00d94b9624d3e86e0935c3582396bcce11e8a2231e0f19355959da580367180e
MD5 6efe26c0830369612b4688a9b49fe334
SHA1 769379c985e5ebb6cf00c1ec337030814d9dc021
SHA512 4241ce55a87e87f7643065d5cd523f5990de4bafb90f26c474e07da289ff9311fef9176a1e842d09e4afc89cc488be5cff2646e47c50b1acd0e8ba3f112f429a
TLSH
T1C5612B340B526BADFBE11E72E8E147057432D36DDA73FC1C606056BD6507727642621B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7d3e19b67da5a08dfb37c530a44e3f52773665e753309e056539b1cf92d29ebd
MD5 5545210180e7c67738921e01b6b5eb73
SHA1 5731c9347a8f8f0abd9c7104ea8b1cdd72eae25d
SHA512 a434b238b485012d97d2a348665eae0819aa37b09b096a486e2630ead24daf1252b7f2d69c83eb31c8ecd543cdeadd6916cb8338d47b201d94aebf8847b8d2a5
SSDEEP 192:sxZmK6RreyM/jK1Ml8Mk7b/fb/sw6km3+Idp7mNHW6+WNKmYiT/YLd8mYc3/TIg9:sxZewMP/fjsPkUEHb1/Cr9
TLSH
T16E5209116A346977CCDBD209B955BF53D6F90472D2940E44AEFCDA1C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a0e4a946c487860e7a406a6439f9528af0c21b1c6dc5a443389f043feb3134e8
MD5 3a229c903aff518214f4b9094a917f52
SHA1 8e4863d566232005dd88a21c8216387b448c6307
SHA512 bbf4399b6323841b016b7c555db008a70cb1facee3b5f30ae6aeb20ccb519691e87c16854317384d3ace8034b483f7022f6f7e6a65044ccecde64c6434192d0c
SSDEEP 768:DTs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNMror3:DTs6pD1WvxzWju1jahILIsNXr3
TLSH
T100D20A3B680CCB7E4F841E5CEC2AAF966DD801CBAB98894447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 00191e9af1a87ee23d668c2e2305295b54d6562a3c7197058c33599c2494ea5e
MD5 4478918a7532dc6c5195b3270126b2c3
SHA1 3573289c535a5c12bf09edaa0bfffb4baca3753e
SHA512 c1dee31a95e975b87ad6d8f83a64f2779e63f2c4ae2519aec12c4d8c770010e2ee5de2b880e92e2440ea418902bab17b56aa8ac97cbc9778f105168a16b1bce7
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyhoIrKVicPdIxK2cUjy4nIZKYIs81:KUAAKtePiogKVi2dqK2c6bneKYIf1
TLSH
T164C1F71736BA02423D3E2A4C83D59B678E8271533019A42B3BAC0471DE66E21DDFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d3e71b016cbf75806f82492085f7d05023af5afc490ccd5d0f1c884a357e43e3
MD5 a3f8f0e10281ec23147860df18622781
SHA1 bbf09c35d03d45b10c5710cf759fdada2ed0f41d
SHA512 ac1a29f9d4d47a581f6b88a714fa1396aec321e418731cc3cd00340db48d8ab1efc0d46e6b26bcefb5866809ee05c6f89a7d26f4e7530c973c8a0fd564411043
SSDEEP 384:qZcIhsN/NGpMntYu4a91O+MzozJrI2ivJU3o1:Ih7+nlhHOZMhI2iai
TLSH
T10A827C315C785C7619F6E184FA4729179FB98027AACA6F80D5DCAF1D01DF5A82307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3fa27319fe3ce07fc880c3130723f0c9b6d83802e47bc244e7195fbbdc366614
MD5 718c99274005bb0025924dab4d43b5cb
SHA1 f79b3a67b2f7b5eb0a6dcaff6ab791241ce75817
SHA512 d06ba89881e0b3446abb949552af432590e9666931aaaf0b379ed89a8208f4e4a2f475e49ae78349c857a52c6697bf0334836cc528723f01bd07f53b01f7e225
SSDEEP 192:qONQ6O7+3hQmiUymKmeGttb0IO25h2sgG1bv1U6:qONQ61WGt91O+MCJ1U6
TLSH
T19202D93468286CB74EF2AE45B68737239FA5112BE9962F84D6D81E1C00D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d98f876752644907787089ebc85c54a13c7f07b024cc48c68fc9209ef1ca2db4
MD5 cd12d76cd34f77c42f89846b8d87d99a
SHA1 1d3c0ba34afb2950e24abcdb5caf1a4fe6c19ee8
SHA512 28e0b54edcb3a90fb638c5a3c1a3f57db2d3301bc6501a934029ad81be231260e2cf445a722ba6e120e7beab4f724714774fa68491d3de41a68f5a354157369d
SSDEEP 192:oLON8/6O7+3D0QmiUymXmeozttb0IO25h2zMZF0SJrCcN1IqeJU6:YONS6uDIt91O+MzozJr72U6
TLSH
T177121A35A8689C775EE3A541F98735138FA5412BEE8A6F80D5DC2E0C01EF66C334AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 23b58e8f980f2af4dfdcd83f08c119e2bbab52a2db4edf3a237fcba268202ca7
MD5 07ad007a4fcdea1be6f008fddba5aa17
SHA1 90ab8d756c5fd2c5991e7e41bb0a1303d1fd2575
SHA512 666605b54893e3418f53ed5793f7340bf956c2ae41c48d527399b75b5688b1fb0947c1640785caa965ff8cdb71070f62803172c34cc0a78e07bd97dc5dd7c570
TLSH
T1C4411688B6E91148B3B76F56ABF6A86D4C7EBC732F06D19D10010E4E4626E40CCA1B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads