Overview

overview

7

Static

static

1

URLScan

urlscan

1

https://drive.google...

windows10-2004-x64

7

Analysis

  • max time kernel
    300s
  • max time network
    258s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-11-2024 20:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://drive.google.com/file/d/1hC2EXp57Mz7nty9riGYHQAw2RpiyY0bs/view

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 23 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1hC2EXp57Mz7nty9riGYHQAw2RpiyY0bs/view
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:316
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2a4e46f8,0x7ffa2a4e4708,0x7ffa2a4e4718
      2⤵
        PID:4620
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,13377517430756879268,16645130727508932656,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
        2⤵
          PID:1780
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,13377517430756879268,16645130727508932656,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4668
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1968,13377517430756879268,16645130727508932656,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
          2⤵
            PID:4188
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,13377517430756879268,16645130727508932656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
            2⤵
              PID:5116
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,13377517430756879268,16645130727508932656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
              2⤵
                PID:3328
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,13377517430756879268,16645130727508932656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
                2⤵
                  PID:4896
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,13377517430756879268,16645130727508932656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
                  2⤵
                    PID:1400
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,13377517430756879268,16645130727508932656,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:8
                    2⤵
                      PID:4680
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,13377517430756879268,16645130727508932656,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4276
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1968,13377517430756879268,16645130727508932656,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4916 /prefetch:8
                      2⤵
                        PID:1920
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,13377517430756879268,16645130727508932656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
                        2⤵
                          PID:4344
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,13377517430756879268,16645130727508932656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
                          2⤵
                            PID:5264
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,13377517430756879268,16645130727508932656,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
                            2⤵
                              PID:5272
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,13377517430756879268,16645130727508932656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
                              2⤵
                                PID:5484
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,13377517430756879268,16645130727508932656,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
                                2⤵
                                  PID:5492
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1968,13377517430756879268,16645130727508932656,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6832 /prefetch:8
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5260
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,13377517430756879268,16645130727508932656,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4072 /prefetch:2
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3540
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:4344
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:4912
                                  • C:\Windows\System32\rundll32.exe
                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                    1⤵
                                      PID:1808
                                    • C:\Windows\system32\NOTEPAD.EXE
                                      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_FL Studio 24.1.2 Producer Edition KioNathan 2.zip\FL Studio 24.1.2 Producer Edition KioNathan\Installation - Instalacion.txt
                                      1⤵
                                        PID:4760
                                      • C:\Users\Admin\Downloads\FL Studio 24.1.2 Producer Edition KioNathan 2\FL Studio 24.1.2 Producer Edition KioNathan\FL.Studio.v24.1.2.4394.exe
                                        "C:\Users\Admin\Downloads\FL Studio 24.1.2 Producer Edition KioNathan 2\FL Studio 24.1.2 Producer Edition KioNathan\FL.Studio.v24.1.2.4394.exe"
                                        1⤵
                                        • Loads dropped DLL
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of SetWindowsHookEx
                                        PID:740
                                        • C:\Users\Admin\AppData\Local\Temp\nslE90A.tmp\flstudio_win64_24.1.2.4394.exe
                                          C:\Users\Admin\AppData\Local\Temp\nslE90A.tmp\flstudio_win64_24.1.2.4394.exe
                                          2⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Drops file in Program Files directory
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of SetWindowsHookEx
                                          PID:4508

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Program Files\Image-Line\FL Studio 2024\Data\Patches\Impulses\Exteriors.nfo
                                        Filesize

                                        29B

                                        MD5

                                        c9e2cc184f1dd73cd5a66abcd8c6e0cd

                                        SHA1

                                        ccb180bc3ef502a872f88d591a90571fd8c61fae

                                        SHA256

                                        c5705dd82713be76cc5e4c1930589106d67cab8b6e905768a21233c77387db31

                                        SHA512

                                        addbac550b8d084e8fb95cf82d7ccb13acdf434b2aaa63b8e7b8bc09a9cc0e5ecd8d8121762a0de6eb69d8ac4f07d7ae9b5b0969f72d36f5b042d76df181887e

                                        Download Submit

                                      • C:\Program Files\Image-Line\FL Studio 2024\Data\Patches\Packs\Drums\Kicks\Monster Kick 005.nfo
                                        Filesize

                                        36B

                                        MD5

                                        1406de33f68d12ff32f186da3a596309

                                        SHA1

                                        0d4c28f3f5a9290c553a33312bd0686ddda28eb2

                                        SHA256

                                        f55f810b44800b37393cc2a97d85595f2a0ea3cd9c4d4416dc00c9dc8badc3d6

                                        SHA512

                                        143282705c3c19a24b217653b8af2cdb5378a4adb0b5093fca2643a38be74f4fbc06e9551d75f854091855ddc401fb65ae4560aa865a638346a831e7b9100d0d

                                        Download Submit

                                      • C:\Program Files\Image-Line\FL Studio 2024\Data\Patches\Packs\Drums\Kits\Groove Bias\snare 4 v7 rr1.wav
                                        Filesize

                                        9KB

                                        MD5

                                        d786090570f1b09f694aef4b78b5fb44

                                        SHA1

                                        bb063717c78da303499bb0239ab6de0cd99ea079

                                        SHA256

                                        f8c31012d32c60da332a6204133b832e610a38ba9506e42606fafc6d9b77053f

                                        SHA512

                                        25cabe81af1c5ccfb45de1c37f2064a4784842a1c03513a6ac59d5e5d49de684961a683d2dafa269087fe5b88b7f0551448f5a9cbd8a490a81cd30822ba7aed3

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                        Filesize

                                        152B

                                        MD5

                                        dc058ebc0f8181946a312f0be99ed79c

                                        SHA1

                                        0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

                                        SHA256

                                        378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

                                        SHA512

                                        36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                        Filesize

                                        152B

                                        MD5

                                        a0486d6f8406d852dd805b66ff467692

                                        SHA1

                                        77ba1f63142e86b21c951b808f4bc5d8ed89b571

                                        SHA256

                                        c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

                                        SHA512

                                        065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                        Filesize

                                        480B

                                        MD5

                                        59e8ae4f65ed9be425607aa3ee9a8d16

                                        SHA1

                                        ca5b8429cd896eb57e76102c3f54488996297622

                                        SHA256

                                        073c18a4893d894b3b754703b05073d0413c07f1f037e00494ba4fa47aef1de4

                                        SHA512

                                        6144b56375d70448aebf38d9df49e9752d3acd955e086a894489cc5239d59f23a0a86308e6c33c0dddde1f1dd417d0dbf6867829559b8053dd10660133a9d3b3

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                        Filesize

                                        3KB

                                        MD5

                                        593a1f1b14261e75dc38ba02719317c2

                                        SHA1

                                        75bf7dd767658639e1a3dbd2e6ff02bcb5bab67f

                                        SHA256

                                        b7bea7abb3b0c88cf0b986069b9da7552f7de0f5076927ff991038dd2ca2e9b6

                                        SHA512

                                        9b692e16f7c777858eab29121572d7b50053ebf8ee73043e334aefadfdefcfc3cacd37e725949b1094e68b5b83671b3354f5d489307ec39ad2b391fcf5495e64

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                        Filesize

                                        3KB

                                        MD5

                                        73e5134e9775240270088826d60d280a

                                        SHA1

                                        4f120e339d7691ed3a160f42dc40609e87b2a4b8

                                        SHA256

                                        6c8c8dd6a3579828a80fc8704f33d3c4e4e0f0f41af6602038639d3fbca08aa4

                                        SHA512

                                        e622a0eaf8f78e1a5543cf098fc01d83aaf2e883ae4d9891a703139dcf88598f077eccf56e88a7b7983cb3bec1433655c247e8bebc58ae1cd737f33e9bf954f6

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                        Filesize

                                        3KB

                                        MD5

                                        e2f8f746d0d0c4daea99817d7522df59

                                        SHA1

                                        b39c8cd4004888bf97af5ee3df1652d93f304301

                                        SHA256

                                        d98805b72e36906303b35a59092250b76a7f5b1dac3e23b84ebc90c025e2e646

                                        SHA512

                                        27e5a1c1b3469734fbc3ca3ef9c9842e90a53ed0d565b5f13b9f9c14899d65bf6030a90320ebd0e606f178eeefeab4afa136a21d5c03ea35802fe781fe36ab11

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                        Filesize

                                        6KB

                                        MD5

                                        1c26fe545e9f5f1989e58965cbee4acf

                                        SHA1

                                        86b2288d1cb91505846ef74214b2da7cf4e3c0de

                                        SHA256

                                        9a23895b87ba9956f199f7ad86e487a33ef10f9caa18c6c02074211ca2ad673c

                                        SHA512

                                        035bd82a2563ff9f2ba24f0e4b31c6d98a7f19344713b2fa1271b544037b5a81a0ec681d23bf75b1250e3d5dafe6113b4423dcbb0474e76b8a6415110d70612f

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                        Filesize

                                        5KB

                                        MD5

                                        a22a93bf123c9fc833840c2ef270145b

                                        SHA1

                                        53c5e108b3bfe228e7f3a01e98294156213bb423

                                        SHA256

                                        08cfb9e63788c264be1c9aa79790d533decd0494d3b32855e19d57bbf24164e7

                                        SHA512

                                        ca3fe016decdbb793483b4b313931227a83210d86c2a84566fb6e5f7aa4dd43c1869298bffd46c117bf256b80a37865f3ed87ea62bf87334ceb9a79f47a6a426

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                        Filesize

                                        16B

                                        MD5

                                        6752a1d65b201c13b62ea44016eb221f

                                        SHA1

                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                        SHA256

                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                        SHA512

                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                        Filesize

                                        12KB

                                        MD5

                                        470f13c5c31b26a686d884b6ab1fc239

                                        SHA1

                                        defe219070007c4e6fd5a18d748647920beaf40f

                                        SHA256

                                        c44e3033878e26cf1ca172ce034bdba88325c926eb34b7d04e79f436acf6b592

                                        SHA512

                                        cafef324819057232e9976db1e1c486f21aeeab5263c632c6f645e452dc8fe2d4e1969608237816ad8db1d4090fb0f487b8f70242005cee416dbe4a6bb45a811

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                        Filesize

                                        11KB

                                        MD5

                                        e865ea416e7b4305008642df60df970b

                                        SHA1

                                        bf3e23352e3e39d40a2714620fe1ff8336426c3e

                                        SHA256

                                        39d5555daf3ed086cafc490ac9a378097c80fdda27c886b606f0e2911fc44cb7

                                        SHA512

                                        4d1e9c8bc163e65a0c377bf3620d8f6c1a7824d326bcc8646ab122ce88428570d5f521255b125c250d1be57140f605c5eaf037449b32e807f0a7398006aa04d1

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\nslE90A.tmp\System.dll
                                        Filesize

                                        12KB

                                        MD5

                                        192639861e3dc2dc5c08bb8f8c7260d5

                                        SHA1

                                        58d30e460609e22fa0098bc27d928b689ef9af78

                                        SHA256

                                        23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

                                        SHA512

                                        6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\nst944.tmp\ILSetup.dll
                                        Filesize

                                        1.2MB

                                        MD5

                                        494dbd5993a47b3b720f5e0f6eb04c59

                                        SHA1

                                        08d3f00ee435a9ddbb0afe7869a3183bd3e0a284

                                        SHA256

                                        bee6fc430a05bdcf82226adcbbfba9abbe08fc065b97c1f2cfeb9f9c4e34cd25

                                        SHA512

                                        2e9305862c5c55e37d5533b6392a428694858880a8ca533f9a7260b7ee4220b79b5d45f5645526b631a05bfaa9fc0725b6e43b0a5681cb36b7b6c413083f386e

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\nst944.tmp\InstallOptions.dll
                                        Filesize

                                        15KB

                                        MD5

                                        998189882c9f1be220c9faf0fd2bde15

                                        SHA1

                                        787d50c46c9a2a48565f684fabc7503aca8b0493

                                        SHA256

                                        f34385901206a3952fe2724edb3b0b123fd897119c774ab68c8745de6662d990

                                        SHA512

                                        e0c52ad851b476e7bcbadea8f993e5c6f9f70a9b46e2aebe8ee353a372b0bd5af95241240f880f49b9d91d240a4a2b7e7d2b7c8a18ca1654e607fa8d2772dfd6

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\nst944.tmp\System.dll
                                        Filesize

                                        11KB

                                        MD5

                                        24523fe14bb9ba400a3950016b187915

                                        SHA1

                                        6ec152b4e4ac04038d4608a8a206070185116036

                                        SHA256

                                        c4aaf80e3990185eeb5ea56bf841dbf5f3d02269d715f3bfdfe8b54aa797a7b9

                                        SHA512

                                        ae73351d27109187f7c4e312bc30a165202f29d74c65dd0feaee75dab72b97d27c6482b1e95771063afec7e9f2ca03a27a11cd25e39228072b69c33fffef7257

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\nst944.tmp\UAC.dll
                                        Filesize

                                        14KB

                                        MD5

                                        adb29e6b186daa765dc750128649b63d

                                        SHA1

                                        160cbdc4cb0ac2c142d361df138c537aa7e708c9

                                        SHA256

                                        2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

                                        SHA512

                                        b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\nst944.tmp\UserMgr.dll
                                        Filesize

                                        23KB

                                        MD5

                                        9210597fba3dfab3c69b1eb490205419

                                        SHA1

                                        6e3ca39043756ed1cceaf2d4853e7cb6be1c64cb

                                        SHA256

                                        7696c255014a543f720e189ab3fe48f62fcf43435465062649c96138eedb222f

                                        SHA512

                                        4877daefdd34725791fba7c8cc2d85c4e91080ca7787a71ee9ffde71704ac40799b891f03d1f1805a31af6ddc35e335f74c9d620e87d517670a378c001cffb06

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\nst944.tmp\ioA.ini
                                        Filesize

                                        1KB

                                        MD5

                                        cdf69dcb7a306ae3f218e55a11259a3c

                                        SHA1

                                        db0045965972c69430086cbc8dd433a73328e1a9

                                        SHA256

                                        9dcf753a6f895da37b5c5650f17b4fc67484c3b0eee90ae5c98a95bdf1bb0b31

                                        SHA512

                                        cb954c113e71c16623f3b2992edcc48a9e94c32dfcb6553ceffb8069e9acb387c515d2bd996c9b83ca32a868ee404306fe6c22d4af228ccf83572560024599ae

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\nst944.tmp\ioAllUsersPage.ini
                                        Filesize

                                        1010B

                                        MD5

                                        634fd2633a884035690fd3635c7ae34f

                                        SHA1

                                        91af7c2af8a41563d33f944868d22673c6116e2d

                                        SHA256

                                        c0313e195465e521ef5cbd94e19a1abe70cf0d564ec38b017f1e09a276e30c15

                                        SHA512

                                        810389998f4eb641228e5b4e2ec43849102d2d9e1890c17aff5067cbcd0e46bac7850f732815746cbdf62d4f698cc47002cad2aa2f3b442cec3a5652558b058a

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\nst944.tmp\ioAllUsersPage.ini
                                        Filesize

                                        1KB

                                        MD5

                                        f4f4c8eb5f1053d98be36ab8b493e632

                                        SHA1

                                        6650dfb177c57acd329bc353010f98263e3fabba

                                        SHA256

                                        495e4ee7b9e2a0d2128a687d64ea3785f1a3edae09d8426d9c5345700134ba52

                                        SHA512

                                        3e8f011138e5874a6168b0305fba1eaa28ba66f7a095e3272b6bec1cf87d560ba9e02674ff80851f38d9257a928dcf85901bbdd4442095ffda2463a5e4f6fc0e

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\nst944.tmp\ioSpecial.ini
                                        Filesize

                                        1KB

                                        MD5

                                        a2707fd7e091ee7b881f249d15a3d3b7

                                        SHA1

                                        4685194d6d9a74e972361388c6f5673eb43943dd

                                        SHA256

                                        4eac984d43b68b2f52acb4bd76e71f015c49a288b5e79522ba21c8569bb177ab

                                        SHA512

                                        c41a42809cac51a1e7512f82d8356de3534b894d3bc6b9b94c0ff55c6653f5e99775efcfae6d1fd3966318169f6f8ca9a1e2d84fe3ad1f05e9573b8fb354ef68

                                        Download Submit