1f1577ec8a4d17de211b6d39d4687f284e51d30dd02344da9f16ae81707c5d52

Analysis

user interaction
yes
max time kernel
11s
max time network
12s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/09/2026, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
view.html
Size 123KB
Sample260905-tf782seq3s
SHA256 1f1577ec8a4d17de211b6d39d4687f284e51d30dd02344da9f16ae81707c5d52
MD5 f8b531ec762c3a626cd2b91bb9515e4c
SHA1 2f2398375fe111282844915e240bb1f529caed95
SHA512 833293dddd7a06eef7e9ee6a5eca75b571e84594e50622c4fd971732c26248484c3822856d79f0b89b800216b3c17388c53d523f147d245ab1a5c916d4b0b757
SSDEEP 1536:xEVVOzHlEizlFzgdPyeIjquUvijquUvzn3:H63
TLSH
T1FDC3626202119CFDEEF784A320891D563E6C1177A3925437F3DD5FA92B974AB022837E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
29	drive.google.com
30	drive.google.com
37	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3420	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330976967228967"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2654269261-3199571979-4291878722-1000\{A943EC49-A32A-410C-8CEE-C4BA21EBE257}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 4020	2472	msedge.exe	80
PID 2472 wrote to memory of 3420	2472	msedge.exe	81
PID 2472 wrote to memory of 3440	2472	msedge.exe	82
PID 2472 wrote to memory of 3440	2472	msedge.exe	82
PID 2472 wrote to memory of 3440	2472	msedge.exe	82
PID 2472 wrote to memory of 4672	2472	msedge.exe	83
PID 2472 wrote to memory of 4672	2472	msedge.exe	83
PID 2472 wrote to memory of 576	2472	msedge.exe	85
PID 2472 wrote to memory of 576	2472	msedge.exe	85
PID 2472 wrote to memory of 576	2472	msedge.exe	85
PID 2472 wrote to memory of 2276	2472	msedge.exe	86
PID 2472 wrote to memory of 2276	2472	msedge.exe	86
PID 2472 wrote to memory of 2276	2472	msedge.exe	86
PID 2472 wrote to memory of 664	2472	msedge.exe	88
PID 2472 wrote to memory of 1924	2472	msedge.exe	89
PID 2472 wrote to memory of 664	2472	msedge.exe	88
PID 2472 wrote to memory of 664	2472	msedge.exe	88
PID 2472 wrote to memory of 1924	2472	msedge.exe	89
PID 2472 wrote to memory of 1924	2472	msedge.exe	89
PID 2472 wrote to memory of 400	2472	msedge.exe	90
PID 2472 wrote to memory of 400	2472	msedge.exe	90
PID 2472 wrote to memory of 400	2472	msedge.exe	90
PID 2472 wrote to memory of 1740	2472	msedge.exe	91
PID 2472 wrote to memory of 1740	2472	msedge.exe	91
PID 2472 wrote to memory of 1740	2472	msedge.exe	91
PID 2472 wrote to memory of 796	2472	msedge.exe	93
PID 2472 wrote to memory of 796	2472	msedge.exe	93
PID 2472 wrote to memory of 796	2472	msedge.exe	93
PID 2472 wrote to memory of 3336	2472	msedge.exe	94
PID 2472 wrote to memory of 3336	2472	msedge.exe	94
PID 2472 wrote to memory of 3336	2472	msedge.exe	94
PID 2472 wrote to memory of 4784	2472	msedge.exe	95
PID 2472 wrote to memory of 4784	2472	msedge.exe	95
PID 2472 wrote to memory of 4872	2472	msedge.exe	96
PID 2472 wrote to memory of 4872	2472	msedge.exe	96
PID 2472 wrote to memory of 1896	2472	msedge.exe	97
PID 2472 wrote to memory of 4516	2472	msedge.exe	99
PID 1896 wrote to memory of 3276	1896	msedge.exe	100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\view.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x258,0x7ff966adc188,0x7ff966adc194,0x7ff966adc1a0
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,2497880584355980760,18073795475778580013,524288 --field-trial-handle=2332,i,2851673382927245124,14203176824962637541,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,3430474276650588618,2104799617454623767,262144 --field-trial-handle=2332,i,2851673382927245124,14203176824962637541,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:2
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,13427167608552373038,4995888749540031441,524288 --field-trial-handle=2332,i,2851673382927245124,14203176824962637541,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:13
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,10225257781159326471,3967768285845987363,2097152 --field-trial-handle=2332,i,2851673382927245124,14203176824962637541,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,6419887170140130676,786861876768764253,2097152 --field-trial-handle=2332,i,2851673382927245124,14203176824962637541,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,12703244035669239706,17702636645448193893,2097152 --field-trial-handle=2332,i,2851673382927245124,14203176824962637541,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,11613110061198978557,10195585175356576470,2097152 --field-trial-handle=2332,i,2851673382927245124,14203176824962637541,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:9
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4240,i,12530937148215021727,13473931833838865044,2097152 --field-trial-handle=2332,i,2851673382927245124,14203176824962637541,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4220,i,192039049109060733,1445968895677217124,2097152 --field-trial-handle=2332,i,2851673382927245124,14203176824962637541,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:9
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4272,i,9652753347343909400,17613992889013166439,2097152 --field-trial-handle=2332,i,2851673382927245124,14203176824962637541,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5436,i,8729664244537893946,13054677195264781561,2097152 --field-trial-handle=2332,i,2851673382927245124,14203176824962637541,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,7984946747985491796,12823993469839014691,524288 --field-trial-handle=2332,i,2851673382927245124,14203176824962637541,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,10608944442031729795,9230771684326456888,524288 --field-trial-handle=2332,i,2851673382927245124,14203176824962637541,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,12754978901587194235,12338767103719751877,524288 --field-trial-handle=2332,i,2851673382927245124,14203176824962637541,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1144
    3⤵
    PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,16968491812711421431,9315767845408220924,524288 --field-trial-handle=2332,i,2851673382927245124,14203176824962637541,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,16968491812711421431,9315767845408220924,524288 --field-trial-handle=2332,i,2851673382927245124,14203176824962637541,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
  2⤵
  PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bd5dff6b6a2953b678276fe774acb1020dcf956eee918258c4fbcebd9799de50
MD5 ad9e9cc59d40b3c4a865c23e526c194b
SHA1 ec6e5c23153f46461256dc2ee3316df628e2eda9
SHA512 781d6d2d74c84caa1d22367f03cb2eef3a2125624c47277182248dc2b092992ad8756b1ea9759b2d56ee2b90c008cd691688382416e421209d33f546892f8550
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7da5fd99a0ab66e77a1c7d418475484f3755ec6c2945de3295f2577e789df01a
MD5 39ab0f1d6d7946d873f1bb6929a4c13e
SHA1 c59f4f27654295f008fbfc2411a1ef79ea54cec0
SHA512 e470432f3c728552a9408dd90789bb6c2ace1ee0142fae2a37ea0127d228691c3150637174b3202058e5952e25dfd9256f96a6af74b77d36328dc528bee21aea
TLSH
T10BD080332F1D7041FB1D4730D463CB24277F845638478616B211C40C99754C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 23823794b3b6267e9c083ddaf520ee01fa32d4516798865f1445a1abc4b04bbd
MD5 83250c7c4d7b6ef62bd1bf26f4c3e0c4
SHA1 e9602c3da743490459da2b565766ef634e141b1e
SHA512 ca69ff689a6f6e3b7d2372cd69b840c4bfc55765ed02240fdf7742b99373e9bfcada680b5f79ef47adfa800608d07b4a31cf3835f5c30b056283e46bca076180
TLSH
T189D012232A5D7041EB1946309463CB24266E845628468616B211840C89664C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 de7aca73ea4ae2f7980304f8d6db734ef42267baad1dd90b2f3f76a146dee6b2
MD5 7ff801e78d79819bde00613c0fa58b0a
SHA1 91af5613d2436d3c4f16a05c526f591d9fa73a66
SHA512 16e9c4fe18026b6066cb529894aac42755a8c00a14510de89320192edf7f66da31e74f71bbb15db476f179c77dda89ec3c5da2247d9ebf04cce9db3ed3453c8e
SSDEEP 192:sxZvRNyM/jK1Ml8MFx/fSsUcDIjIdpyo/W6+WNGY0uBHTDgdIgrJ:sxZvhdx/fSsUcDI8z/bG5ue9
TLSH
T1F442F9126A346977CCDBD209FA55BF53D6F90472A2900E44AAFCCA1C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 69c82bfeb4914f13c0cd2de255730f5bca66db9c60b8b3e2634e3bcff84140a6
MD5 2b248254b928346d0a9f81e0a0c11fde
SHA1 c4f183c45ba85ab9de72575dd041aa34189a8093
SHA512 30e65676afe70339a5a9289b27a4e532c402ad2c5ac330583797f284d68f1a9fd171d346619b4a542ef618d49fe796864b725b79e36e795f97dc28fbb0dfc022
SSDEEP 768:Uj/Lh8dF2/kWRmAcQ3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3KjLl/060lfXrozF:Uj/Lh8dF2/kWRmAcQ3wu1jaKKjLp0DlU
TLSH
T1D8E23B3B690CCB7E4F840EADEC266F976ED801CB96684D5447FA894C03C73EA411A59F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 4225e3453481ca7aba9441452c906cb125878b8f3f94386ae7a2fbef5ca521c8
MD5 84465581432a3b3376190faa3b917026
SHA1 7b0e52ff8ce2ccbb83b739295ea4ced3d3c9594c
SHA512 7e0cd201055cd2ccc5d185a8fae3f04f66f46918f1cc403ea36f0ec5eb30ecb4ae19306a44dcd984483a684b134e2399859c0c05711248cbffa821c0ec3264b3
SSDEEP 48:K08I/KFGs3uI/Kv60ryI+vKO0YEg4gtzIBWgKO1Wsg6mwTdMety1rIZK4IcD:K08gKFGquoKv6quh2KSUCerqK4IQ
TLSH
T149B1415375BB02023C7E2968969187660B427667312CA53F7BF804B74E66E360DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa285496-17ef-4037-8e57-3f496aa4306f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fa285496-17ef-4037-8e57-3f496aa4306f.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b506ec1ddf21811f0ebf1b6bc5500f88b616ad2bd49b550634adbf72c8bb5b45
MD5 65492001258ad3365adbea6bec1e887e
SHA1 73710fdc6e4882fb22c4c4ed29a2a55d981690f8
SHA512 025890bb9a3652acd3efeb7428a0703f0f44d77fb3014fefdbaf189cfc0f3b7f7d0818b34fb9d6b8b9c8b31c72124136e3de7ac072532903a1f9724260aa32d5
SSDEEP 192:usgp8NcLEHQ7940HINQmiU1YuPMB40F2oP1xljzorKkof0Xo+BpW7fqcLqy2:08NcYHi40HSTMu0Fptx58Kvf0X3a7PX2
TLSH
T18E522A376C346C7B9EE3A555B5463A13AEB4406B9AC42F84DAFC5B1D01DF39C1306C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3598c826d2120da56fd44aa8d194c8f2b9995e7c1d2fcdb7b3018252b0d8f8a9
MD5 b07b2a0cf5275de7f2ed30dee9a50d5b
SHA1 dbada08ed982dec3471956b5db09500db857d649
SHA512 d4387a2ff771cb510ec0876612514fd2e8f10292823af98a9764ef8a8417940aed3355b98c413760700a63386cc2e492e911607c67be201e85ac9acc7b55d303
SSDEEP 192:VGNt6d940lQmiUyVuK3BF2oP1xljzorKkof0Xo+siD7fqcU6:VGNt6740DU3BFptx58Kvf0X3V7PU6
TLSH
T1FC12FB3668386C7B5EE37995B4873613AEE5411BEE887B40D6FC1B1C01EF69C134AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6b0f98e6e010d3dcd3f259cdc0a10eea5f5fa114643ec42349cc761d9a44115b
MD5 350ad180b0797c585b2ff38b9b501681
SHA1 d8839725760771471a5be63081bd4f475c45d37f
SHA512 2f6380e24d14dcbbce15290639c028507a3ac6337ba517add3246039ae570ebc9cbce7219f16c8f5b07d2fab55462455c370cfc7b645b884629f937c43912058
SSDEEP 192:qGN46d9402QmiUySvuKTBF2oP1xljzorKkorGw7jvUvpU6:qGN46740SVDTBFptx58Kv57OU6
TLSH
T11102E9366C386CBB9FF36E49B4473B136FE5116BA9942B44DAF81B1C00D778C1346826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads