hxxps://gofile[.]io/d/HM5QB6

Analysis

user interaction
yes
max time kernel
899s
max time network
732s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/HM5QB6
Sample260628-e336aafs4n

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
45	api.gofile.io
46	api.gofile.io
48	api.gofile.io

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5704	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270945431229112"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4274393721-1801116158-3678143273-1000\{548DB894-E673-4E56-A318-A4E5B518148C}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1564	msedge.exe
1564	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe
6312	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 6312 wrote to memory of 2748	6312	msedge.exe	90
PID 6312 wrote to memory of 2828	6312	msedge.exe	91
PID 6312 wrote to memory of 5704	6312	msedge.exe	92
PID 6312 wrote to memory of 2828	6312	msedge.exe	91
PID 6312 wrote to memory of 2828	6312	msedge.exe	91
PID 6312 wrote to memory of 4544	6312	msedge.exe	93
PID 6312 wrote to memory of 4544	6312	msedge.exe	93
PID 6312 wrote to memory of 6956	6312	msedge.exe	94
PID 6312 wrote to memory of 6300	6312	msedge.exe	95
PID 6312 wrote to memory of 6956	6312	msedge.exe	94
PID 6312 wrote to memory of 6956	6312	msedge.exe	94
PID 6312 wrote to memory of 6300	6312	msedge.exe	95
PID 6312 wrote to memory of 6300	6312	msedge.exe	95
PID 6312 wrote to memory of 1196	6312	msedge.exe	97
PID 6312 wrote to memory of 1196	6312	msedge.exe	97
PID 6312 wrote to memory of 1196	6312	msedge.exe	97
PID 6312 wrote to memory of 2692	6312	msedge.exe	99
PID 6312 wrote to memory of 1432	6312	msedge.exe	98
PID 6312 wrote to memory of 2692	6312	msedge.exe	99
PID 6312 wrote to memory of 1432	6312	msedge.exe	98
PID 6312 wrote to memory of 2580	6312	msedge.exe	101
PID 6312 wrote to memory of 5988	6312	msedge.exe	105
PID 6312 wrote to memory of 6024	6312	msedge.exe	106
PID 6312 wrote to memory of 2072	6312	msedge.exe	107
PID 6312 wrote to memory of 4168	6312	msedge.exe	108
PID 6312 wrote to memory of 4168	6312	msedge.exe	108
PID 6312 wrote to memory of 4168	6312	msedge.exe	108
PID 6312 wrote to memory of 3972	6312	msedge.exe	109
PID 6312 wrote to memory of 2784	6312	msedge.exe	110
PID 6312 wrote to memory of 3972	6312	msedge.exe	109
PID 6312 wrote to memory of 2784	6312	msedge.exe	110
PID 6312 wrote to memory of 2784	6312	msedge.exe	110
PID 6312 wrote to memory of 6984	6312	msedge.exe	111
PID 6312 wrote to memory of 2172	6312	msedge.exe	113
PID 6312 wrote to memory of 2172	6312	msedge.exe	113
PID 6312 wrote to memory of 1564	6312	msedge.exe	115
PID 6312 wrote to memory of 5680	6312	msedge.exe	116
PID 6312 wrote to memory of 5680	6312	msedge.exe	116
PID 6312 wrote to memory of 5624	6312	msedge.exe	117
PID 6312 wrote to memory of 5624	6312	msedge.exe	117
PID 6312 wrote to memory of 4320	6312	msedge.exe	118
PID 6312 wrote to memory of 4320	6312	msedge.exe	118
PID 6312 wrote to memory of 4808	6312	msedge.exe	125
PID 6312 wrote to memory of 4808	6312	msedge.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/HM5QB6
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x2cc,0x7ffbe917c188,0x7ffbe917c194,0x7ffbe917c1a0
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,15032365070294074660,3593433201789080287,262144 --field-trial-handle=2220,i,9487675815173456296,12908839163656979869,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,17970725999548648074,8660172519828088830,524288 --field-trial-handle=2220,i,9487675815173456296,12908839163656979869,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,1269692907939810832,2910638066298904473,524288 --field-trial-handle=2220,i,9487675815173456296,12908839163656979869,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:13
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,16769050171639977113,3103001186092339355,2097152 --field-trial-handle=2220,i,9487675815173456296,12908839163656979869,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:6956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,5161537167658091513,14522080816078669768,2097152 --field-trial-handle=2220,i,9487675815173456296,12908839163656979869,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:6300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5048,i,8941896909575973016,11014899859827626362,2097152 --field-trial-handle=2220,i,9487675815173456296,12908839163656979869,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,5035269076742596638,668963165615733013,524288 --field-trial-handle=2220,i,9487675815173456296,12908839163656979869,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,14071262021275290673,8759397439522035426,524288 --field-trial-handle=2220,i,9487675815173456296,12908839163656979869,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:14
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,6868544282362091900,7681689489828103123,524288 --field-trial-handle=2220,i,9487675815173456296,12908839163656979869,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,6868544282362091900,7681689489828103123,524288 --field-trial-handle=2220,i,9487675815173456296,12908839163656979869,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=596,i,15609044720607824366,4336126639376851938,524288 --field-trial-handle=2220,i,9487675815173456296,12908839163656979869,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,7121655181986512269,16882503262908009312,524288 --field-trial-handle=2220,i,9487675815173456296,12908839163656979869,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,3397912680230595824,16572026023265798360,524288 --field-trial-handle=2220,i,9487675815173456296,12908839163656979869,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=2080,i,2030752047453954676,11748261421646790232,2097152 --field-trial-handle=2220,i,9487675815173456296,12908839163656979869,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,15504319793264400011,12183587340700754986,524288 --field-trial-handle=2220,i,9487675815173456296,12908839163656979869,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:14
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6364,i,2066220950236765951,12877535016870160020,2097152 --field-trial-handle=2220,i,9487675815173456296,12908839163656979869,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,14508759857329073069,11562014548893933582,524288 --field-trial-handle=2220,i,9487675815173456296,12908839163656979869,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:14
  2⤵
  PID:6984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,17758853214619650784,16951467456086585086,524288 --field-trial-handle=2220,i,9487675815173456296,12908839163656979869,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6180,i,2284886782497629936,10307632791164828515,262144 --field-trial-handle=2220,i,9487675815173456296,12908839163656979869,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,13709417428362730076,11594370574752238244,524288 --field-trial-handle=2220,i,9487675815173456296,12908839163656979869,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,6889848284735627727,16359141986322914357,524288 --field-trial-handle=2220,i,9487675815173456296,12908839163656979869,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,9347954163013812961,7402963705105290519,524288 --field-trial-handle=2220,i,9487675815173456296,12908839163656979869,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,12412684667192203551,8393010403970792882,524288 --field-trial-handle=2220,i,9487675815173456296,12908839163656979869,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
  2⤵
  PID:4808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4796

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3080

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 afab44831d15737b93a51b5da32d6f7ffdeb215ed2ae065fce98d07ea4026ae9
MD5 577602fc13804460f1a4c682a14371fa
SHA1 75c72bc7e167208774b7c3c199ee72158d472d5b
SHA512 cf269890ba0a2bcf1c40983f5ab82ca0bed90f59b35f5275ced490c8da7884427c1e64cec45fcf6fb345409604822a89ee8e179211bc96abdb7d379a2baa2ee4
TLSH
T112D08021350EB882D11B10FACD62C316711985636263D10E7991D02DCC974D0B3C5597
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a61df6b1b5973a8f8515610c489bd12e6e001f8527beb5b138216e21393998d2
MD5 1413e4dcb4a722f7a2c851bea622b10b
SHA1 a394fd253f2f3468ec63381b79a7be8f141d441f
SHA512 78510b7b5833d69d44a1969dccddd809ed47ba6d93baa551566bbbb962c07880ca89cc801765cdff99b247b04e98234ccb9c522675e88277eebfffcde1a48baa
TLSH
T1BBD08021350EB882D51B10FACD72C326711985676663D10E7591402DCCD74D063C5597
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 361e60f02282c40b15e93df0834146b94671e25a3d81ce44d63ff63450a41b79
MD5 3cca03c561d2fdec550bbc31a14755db
SHA1 792b17d4743ad85968986828e6a6e976c952990e
SHA512 968949b0820cd4a17aa6a53e7bf2677452cc2350d892829e247ab3b66dfe76979a2e5be3db26501e66ecb6341926950921e39c1a810839cb7abe8781e00a3a25
TLSH
T114E07D8998CAC39FB200E88B416C4B0CC2813A0FD7C8ADDE1701CDC83281390FAD39A9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 dd308fab6741e64875ffc42f1b15b7fc948c5c9249f1beaba086b29e12accc48
MD5 edf9ab1da1fcd0d14f8bffad74607f9b
SHA1 3035c53bd925a727d7c0199f5342999a47586fca
SHA512 916469da268f7b951d3e4901ee5e593145a09822bd6eac185aeec35377628aaba4eac699e1b9608446149cf98de45de39a19c9135b6c84b67dc18dec65e6453a
TLSH
T1A7E02684A9C8DF1FF324765B41AA530CC2C03B0EA7C8E98E5B1089DC32822A4F2D6994
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 3d2fa73cf3e0af320354a326766f9ce8c573b81b29b4006b4436c398f9544253
MD5 a2809709a03c7dc6be9e7f2e09a91c35
SHA1 579082b24c548dcc01ded5917a50ee34369ad3ed
SHA512 41f7c845189163dcafa5726cc34b5d55bdbb4f527cfc560657c83b09364d6987ae23e186b5e7ecd4857acba30bd7ba5946293d15e420ef0b976f0fb5c658f1ef
TLSH
T119E0784459C8C31F73A3E8C75155470CC240370FE7C4DD8D5F04CDC83245550B1C6A51
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 19ba996c73ef890ec0b798844b481ad2b3c04a9920d20aae4b6b0eb860c6ef2d
MD5 49be9b6afb34e0605a70bca6f58ab32a
SHA1 c72f4bddb8d715d57927c1e1dbd65833d858b38e
SHA512 054e0fb2c1cea869712f74415599a6e3c97bc8f6c7c791be9f15d106d2fe69761f0067d7a380407b10462c4fca6aa919df48b2181f895961ee106a65c01964e7
TLSH
T129F0F9A9C821EC3708FD0B5970A44A4BF790132B2741995F3B3C920C4FB063F468AD1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 3bf6d2194930d775d071f51f2eb9ec7ca635b6480cf58f989a9fb7281a440c00
MD5 ad99b540ff0b891fa17ca34a1b99030c
SHA1 b5c0553c865289728704f6779b715223f5986db3
SHA512 038deadaf9e03bcbadd12ba623054d7efe10d900f843c5f69061eaea6e3579f8c7740eac21758d12ddadaffd95b2b8f832c9a1cd583b1fef37982a1a2b6880b4
SSDEEP 96:YDTPoVvNDBkFIDhVRHUKkd2M1QzmwExnl2RDIFcgfL9+HLh8KHl2uQEZTO9qbIG5:YDTAVvNDBkSDfRHUKkd2M1smwqnlqDIw
TLSH
T19691C66AB123C5A5C7E10674D9CDB09F333D651223071E51E8A68CF6BB0A36E8C20F8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 bb42c7f9049de2f849c1ada70ac865166582a8c50c0486439b2bfc9a2b1dac5c
MD5 c50c306cefcb3979d24d22564db0fa0c
SHA1 5603937062cd9afc797df5752024840ee8ee8b8e
SHA512 ff5abe97f65aa25e43f17c1aa1e045d4f00d940cb2eb4575d813eac8df808bc5d75ab6e6859c099b2fa363832cf1c28b8d7fa296751604877d37aa5a15e11bc3
SSDEEP 96:sDgSvNDB5IBVRgkd2M1Qz1Exnl2RDIFcgXLh8KHl2Esg/ASfJLg5ugvO+aSA/ke4:sDXvNDBO/Rgkd2M1s1qnlqDIFcgXLbH4
TLSH
T1C991C6486427D1B5E7E10634DACEA0AFF33C654261830E51E8A45CF67B0A72E8C61F8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58e0e5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e0e5.TMP
Size 3KB
SHA256 5b3b95958cb50dc3c2d7a506d1b5defbd47d7e4289287c6598ac563cdab1dda0
MD5 3d01141cb291cfff8a99fca5ed23464c
SHA1 39ddecadb04599ab8ed314d7b4fcb4a95bb9b934
SHA512 ae35e9e882a79df1aa2c1afc49207e0fb483f08a1e856960ac944e7a9f14583d79dc98b870e7e9c9e9fbee494612a8f2ae77f461618977ae901e2d917528d556
TLSH
T10B71C7882523C9A9CBE10678D9CEA0DF337C695165471EA5E0A45CF4BF0A76F8C61F0C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 cd88850687d18b65bda88821bb0fd2c5f8fcf956f96598570d7c431bf11b3df2
MD5 e71ec2fc58af8753ba8822758386e37c
SHA1 65f63529484a18f1f192661a5e6a369784d8878a
SHA512 9680c0b0472a114f7451f132a678a7976d72efe09685d674f51adbc741423787a9b51bfda8d326ef1f8595d33e6a977ea599b839ae0c566585bfdd4bed774694
TLSH
T15561CFF3C3F8856DDA1195F0BB046E2BCE1D0515832C3D6A89E0AF1BA3E3471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 3f2202d5d76ca966d31177f7d6a4ffc1e49a002767876e521dd758ea2532d5d1
MD5 7a3aa21c3415c59fdaa8b245ba5d92fb
SHA1 1ab12fced04f109f5652c35d98fdea546f01e35f
SHA512 fcb1ba98579bf245c7d8636e76c9c80688bcd99ab354a3528a4e6c14dd91f7a1446ff0bc089e36ea923b1d48a8d1b9e519c730a755aed2feaae2a83134344ed8
TLSH
T14551CFF3C3F8856EDA1196F0BB14AE1FDE1D0515832C3D6A89E0AE1B93E3471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1023B
SHA256 c47b1d08777bfd8f80b60e9771a13db2e2881efc01e1ed639d7a2c121f7d242d
MD5 ffe70a42450db52949d197bf44681084
SHA1 646d9b6ae4680a5c5728bb74d096ef9bc5cdc182
SHA512 81e63fec3feba2bd9ac363f444b2e0cee1978de73feaeff69be18e5ecc1139d0aedf3b5f39caff2a53d560e4aadebabad7fb5727196b2f5ed8c5e54feb88cdbb
TLSH
T1E91159D3E9BEF87F10280C3A2E883C066DFDB532029154F5DA66D66D7181AFB4B0A056
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 22ed0a894cc50154d2237138227d77a7c63b4c314e738cada7811ab677dcd5a6
MD5 c0aa8b4e0255da07c39237d97e9a35f9
SHA1 a5b654f81f818a167bf1edef57dd18e52f66d664
SHA512 d1e5a9727804e739878a8199b4b9afed357d34392437a1c7e738f1c7364596ccb2fa1cfdbd4169b40c01793c5e59f221e7a69f6fc3ca6367ecab51a0693945b8
SSDEEP 192:sxRGRMyMqZjK1Ml8wFn1/fxsSoCxWsZuA0zoA8pWlY/g6+WNMVy/YJDrqDv1GqmJ:sxRGpb1/fxsSoCYSDv/5T/Fvsjd
TLSH
T1E362E9066938897B8CDBD609FA857F63D6F81163E2505F44AAFC8B0C01E7ADD211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 508f67e78caf720fffac472246e9b044c03af0ac97708c7b4bad6c7349a8f3c1
MD5 4414ac8af3bc1640c83736394d84bc5d
SHA1 a4dbe62a150d57739b0be63e17d303d11639c809
SHA512 e91980ef42f48442deff9b2a2de08ddca1c59898588a400a65f2568c3cccea28c0dc3718a69faf7d4e150c1a1ffa445ec7e332f1bbb728d00374e6727fa749b4
SSDEEP 192:sxRGRMyMqZjK1Ml8UQXon1/fxsfoCnWsZuAmzoA8pWlI/g6+WNMVy/YJDoDv1Gqo:sxRGpq41/fxsfoCWSVn/5T/7vsbd
TLSH
T1ED72D916A538997B8CDBD609F6857F63D6F81163E1505F44AAFC8B0C01E7ADD211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 91fc157443756ccb2afe439faf44133fd4a4f983ed29b8c599202b7e2311fab7
MD5 228b97a96f0957e881904ac80f29f1c4
SHA1 185b120738fa31f15de070836d56a356df9658f7
SHA512 b0c2acd693248aa632daa1b57206083ec5be7f3a1ac1a43bb8cbf5c6685a8d5377b01f4c44d254f8825a7641f107e4405772b3e0f10dca598fc4fefdd6f89d8f
SSDEEP 768:Aeax56WgGMffA8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4u8CcrofF3czg:Aeax56WgGMffAu1jatBCHd3cM
TLSH
T17EC2FC2B240CC77E4F845E9DEC29AED76DE801CB9B588D5447EA880C03C77EB911A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7c6f714d-1468-4727-aca4-5c93d94ad7cd\index-dir\the-real-index
Size 2KB
SHA256 543202bd084d69b2a73da263b72efa71e6b9896670a1efae55737724b8b9170a
MD5 cda0e9ea4d2d8b6fb21905578c9f011e
SHA1 98d0b2a050c8f6b26a79dd8fe362f3a0b9bb4d22
SHA512 157c8b3a85751d0692b827ce06121c32715fcc08d02431a7d59ec71d23bbcc3e3d5c89711bcd79b44ac04fd12221d56ae93c55067603411148b5a17c03238929
TLSH
T1EB51B85E8C46278ACD78157261B1048C273695DC1E984E0364FC66389CC7A662DD979C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d1f43.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7c6f714d-1468-4727-aca4-5c93d94ad7cd\index-dir\the-real-index~RFe5d1f43.TMP
Size 2KB
SHA256 5b854ba86cfd1f117d1b1deb384531be3136c2187410bf042528b5311bb6cc8d
MD5 abfa7a7eaae685cbf22a5a96ba6e7622
SHA1 42b6cdfd13f5376714f6099c770f6b89084d4e8e
SHA512 b971c4359777dd82fb644ef8997561e5c6f9f7803ae6c3f8acd3bc8307d7838b5afd32b72544d557e8abb7f7f6965ea54cda79a69fc1e6ae25e0ff6bce6d16d2
TLSH
T15151826A8D42672ADD6001739AD64058373BA5605A489F0720FCD634ACC376D3C682DD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 5ec32aba259508cefc98860350253d4bee439cbdef5aa1965b2f92444c3e188d
MD5 3eb53f0d33ca2a4add9548d1259d9357
SHA1 a585ba22e2532d5db9e95a0ad916265345a3e91b
SHA512 44581b6c56544160fbeb15356469593398579fbd18d84d89c5a92437b0d988dc3e390266113a144f764cbcdba329b5308c488b95d79fe480bd84c8b512428082
TLSH
T171E020B72DA72C10EC9FD7D514F96064044578285E86FC4F101692DB50F1765345BC33
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 e82f9cb9913f934240767e722ac8889312cdd4df803943818a9dfd1d816180aa
MD5 b2c261978f1e1c0aab634417e09258f5
SHA1 4100e1f6109f73acbd7431ce53cd63e7950b5c62
SHA512 4e839d793c06366d23ce3492def9638191fab776ede50b14ae9066c00462360d65aa434b630469df60f58519dab79f8c8cdf5f25aad5a5e5b393d9af1d70b50a
SSDEEP 384:CEsqH8wSgMr85QoaiVuNqCBUsDJO9ZfLHob0Vx1pVnopZUP2PHbAzvHvR0Hjrf:CE9RKPHbAzvHvR0Hjrf
TLSH
T1E2B218517A7E224039BE291CD195966F674274B3301AB53F3BBD20E20EA6E004FFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 bf36c8cfee1cf08cf3d7ef8d0c3394c7185862884dea46b2ba3517bf54a54ead
MD5 7973166b9967dfd82bffbe8034dfe820
SHA1 4e3486d625f163295a35fb8ee00031dea2afabac
SHA512 d165bd6a6bcdc30860c0f8f83c6783c2c2413571568e43fa3867b126d673aa9d16d2cbbedcfab816075683a7c530fc0a3588bff42e1e8e442211da0b54aa8d21
SSDEEP 384:nmiF1tNn/s3n9Sej8NnV8TUNTUlIRv/F3aj1Wc2HfoBKC9vkfRyemn15wbAjEO8Z:NF1j+9NUVwgFwJK6KE8f4emn12bfZZ
TLSH
T116C24B36D8A4CA77ACE78BC9B7057617AEE04263C6CC5AD4DAD91E4C01D72DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 1f34f0c4d7931f13bf79ab3f5c008b9a81e963a875b65b18a150b300bb7b6c8d
MD5 b6f24ec3593fcedcf6d554104d20980e
SHA1 5f8b7f24551b1922b79a0907fe0b96c1d62dd6ba
SHA512 90fe423795d9a75c68215759902c3376660b41ee5a2c5fa4f43713d6e7925c2c123ac6f52a021de07132dca503aa9db40239b7eefd6b7ffbf6db25a67097c86a
SSDEEP 384:nxiFftNn/s3n9SB8NnV8TUNTUlIRD/F3aB2Wc2HfoBKC9vkfR0emn15wbAjEO8Uu:YFfj+9QUVwgFwcK6KE8fKemn12bfZZ
TLSH
T1CAE2B3F298D78977D8AE8B87633D2D06A9FCC153B5881994B7D81D4CCD922BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d92a7b48b18e3918a8f9eff2412ff60736dec5dcbead209adb416576d0076439
MD5 e0543270f29fe11519d4fea5c827978a
SHA1 2e87b34a6600d7ab711dc2f4cc8e827210c91ee7
SHA512 9d8a3793a428027ce330d70792b7fb10ac402eac4b535b489f5a40c61fe9bf5f02f73766e686803a0debacc9aeb251172d8ddc7bf2a37964534a0521f77f40b9
SSDEEP 384:nOiFftNn/s3n9SC8NnV8TUNTUlIRD/F3aB1Wc2HfoBKC9vkfRyemn15wbAjEO8Uu:lFfj+9zUVwgFwzK6KE8f4emn12bfZZ
TLSH
T141D24A36D894CA77ACE78BC9B6053617EEE44263C6CC1AD4DAD81E4C02D72DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 234987c4f527f611fd923241b59a086d38f2a32a314a3ec7b87330ed6145cbac
MD5 8ee5923353a54a861c79f84c0b273908
SHA1 3f09ae995394810350f28098ae6ca1bef9e941a8
SHA512 036c603236c9a27c539120534e2d427ec037f78c4d538af72300ee21f11f9211a2f0ede92a317145fc04c9490fc85203397d969acc95aa02b8a621505e55072c
SSDEEP 384:nCiF1tNn/s3n9SN8NI8TUNTUlIRG/F3fGRAc2HfoBKC9vurITGT0I5aU8Lk1Izx/:JF1j+9ABwgKZe06KE2ri+06aFvn
TLSH
T103C23A32D854DA7BADF69B9AB7097647AEF001A3C1C859D4DAE91D4C00C32DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 169fd6040f7ac3fd133999892a2cf4b4b2a7a6733585dfffc920239dc5c8f1ae
MD5 ce08edbeb5f31d526c262900af2b50ee
SHA1 dcfef33c497af242e97c543c7e6feac6c565a458
SHA512 49f9c8f5bfc6ece007ae4d26b41fa9bb3348609e7aae5a866033d4f41805d6fc1725d008a62b473e2c2d6553dec95bb2c4f40ace3412472ee329241795f1b357
SSDEEP 384:nOiF1tNn/s3n9SC8NnV8TUNTUlIRv/F3aB1Wc2HfoBKC9vkfRyemn15wbAjEO8Uu:lF1j+9zUVwgFwzK6KE8f4emn12bfZZ
TLSH
T15BC24B36D8A4CA77ACE68BC9B7053617AEE04263C6CC6AD4DAD91E4C01D72DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download