hxxps://gofile[.]io/d/Hm9fJc

Analysis

user interaction
yes
max time kernel
898s
max time network
729s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/07/2026, 08:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/Hm9fJc
Sample260713-kkjltags4x

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
30	api.gofile.io
31	api.gofile.io
34	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4256	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134284055803896492"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{CAC487F3-2D9B-4AD4-8726-C4E82233B6A6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 1816	2272	msedge.exe	85
PID 2272 wrote to memory of 2576	2272	msedge.exe	87
PID 2272 wrote to memory of 4256	2272	msedge.exe	88
PID 2272 wrote to memory of 2576	2272	msedge.exe	87
PID 2272 wrote to memory of 2576	2272	msedge.exe	87
PID 2272 wrote to memory of 1692	2272	msedge.exe	89
PID 2272 wrote to memory of 1692	2272	msedge.exe	89
PID 2272 wrote to memory of 744	2272	msedge.exe	90
PID 2272 wrote to memory of 744	2272	msedge.exe	90
PID 2272 wrote to memory of 744	2272	msedge.exe	90
PID 2272 wrote to memory of 2744	2272	msedge.exe	91
PID 2272 wrote to memory of 2744	2272	msedge.exe	91
PID 2272 wrote to memory of 2744	2272	msedge.exe	91
PID 2272 wrote to memory of 4908	2272	msedge.exe	92
PID 2272 wrote to memory of 4908	2272	msedge.exe	92
PID 2272 wrote to memory of 4908	2272	msedge.exe	92
PID 2272 wrote to memory of 2652	2272	msedge.exe	93
PID 2272 wrote to memory of 2652	2272	msedge.exe	93
PID 2272 wrote to memory of 2652	2272	msedge.exe	93
PID 2272 wrote to memory of 208	2272	msedge.exe	95
PID 2272 wrote to memory of 208	2272	msedge.exe	95
PID 2272 wrote to memory of 208	2272	msedge.exe	95
PID 2272 wrote to memory of 936	2272	msedge.exe	98
PID 2272 wrote to memory of 936	2272	msedge.exe	98
PID 2272 wrote to memory of 560	2272	msedge.exe	99
PID 2272 wrote to memory of 560	2272	msedge.exe	99
PID 2272 wrote to memory of 1544	2272	msedge.exe	101
PID 2272 wrote to memory of 3736	2272	msedge.exe	114
PID 2272 wrote to memory of 1668	2272	msedge.exe	115
PID 2272 wrote to memory of 2700	2272	msedge.exe	116
PID 2272 wrote to memory of 2292	2272	msedge.exe	118
PID 2272 wrote to memory of 2292	2272	msedge.exe	118
PID 2272 wrote to memory of 2312	2272	msedge.exe	119
PID 2272 wrote to memory of 2836	2272	msedge.exe	120
PID 2272 wrote to memory of 2836	2272	msedge.exe	120
PID 2272 wrote to memory of 3164	2272	msedge.exe	121
PID 2272 wrote to memory of 3164	2272	msedge.exe	121
PID 2272 wrote to memory of 1972	2272	msedge.exe	122
PID 2272 wrote to memory of 1972	2272	msedge.exe	122
PID 2272 wrote to memory of 2820	2272	msedge.exe	125
PID 2272 wrote to memory of 2820	2272	msedge.exe	125
PID 2272 wrote to memory of 4388	2272	msedge.exe	126
PID 2272 wrote to memory of 4388	2272	msedge.exe	126
PID 2272 wrote to memory of 2396	2272	msedge.exe	129
PID 2272 wrote to memory of 2396	2272	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/Hm9fJc
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb4ca6c188,0x7ffb4ca6c194,0x7ffb4ca6c1a0
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,793103591965872577,14289236222860330188,262144 --field-trial-handle=2832,i,14667127780803138070,12344370185815116053,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:2
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2008,i,10025081171104357971,2984321383380709660,524288 --field-trial-handle=2832,i,14667127780803138070,12344370185815116053,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,3304572306785375926,556340742513463435,524288 --field-trial-handle=2832,i,14667127780803138070,12344370185815116053,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,6309206891896460288,8937860278551094819,2097152 --field-trial-handle=2832,i,14667127780803138070,12344370185815116053,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,11599514922724238502,8938033204762522573,2097152 --field-trial-handle=2832,i,14667127780803138070,12344370185815116053,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,7070580915865323256,18142169648197766176,2097152 --field-trial-handle=2832,i,14667127780803138070,12344370185815116053,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4156,i,17006679164151297339,9250538514811129112,2097152 --field-trial-handle=2832,i,14667127780803138070,12344370185815116053,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4952,i,13206853007379809698,4231986727790442285,2097152 --field-trial-handle=2832,i,14667127780803138070,12344370185815116053,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,3466994925435780120,3480401237219819525,524288 --field-trial-handle=2832,i,14667127780803138070,12344370185815116053,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:8
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,6067788812032691622,4212870900590843180,524288 --field-trial-handle=2832,i,14667127780803138070,12344370185815116053,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3936,i,11612721430680645414,16774832218610809081,524288 --field-trial-handle=2832,i,14667127780803138070,12344370185815116053,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3936,i,11612721430680645414,16774832218610809081,524288 --field-trial-handle=2832,i,14667127780803138070,12344370185815116053,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,14947077280962304701,18414017146505772006,524288 --field-trial-handle=2832,i,14667127780803138070,12344370185815116053,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,13806898407555130032,7170528247953140219,524288 --field-trial-handle=2832,i,14667127780803138070,12344370185815116053,262144 --variations-seed-version --mojo-platform-channel-handle=1748 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,5032732808065605773,5416495094840268222,524288 --field-trial-handle=2832,i,14667127780803138070,12344370185815116053,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,17295421732344737121,2719891499869185056,524288 --field-trial-handle=2832,i,14667127780803138070,12344370185815116053,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6168,i,7951555656002416749,13556424360085395673,262144 --field-trial-handle=2832,i,14667127780803138070,12344370185815116053,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,7043670304224737879,10187661142246568421,524288 --field-trial-handle=2832,i,14667127780803138070,12344370185815116053,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,17321108386693709363,12978315392477684929,524288 --field-trial-handle=2832,i,14667127780803138070,12344370185815116053,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,15718831444776844351,17027301895086971877,524288 --field-trial-handle=2832,i,14667127780803138070,12344370185815116053,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4008,i,5627538878101564257,14089747528088185095,524288 --field-trial-handle=2832,i,14667127780803138070,12344370185815116053,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4004,i,12671026951309797509,10135256656470906413,524288 --field-trial-handle=2832,i,14667127780803138070,12344370185815116053,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,7225841424628701150,6197726749718405835,524288 --field-trial-handle=2832,i,14667127780803138070,12344370185815116053,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:8
  2⤵
  PID:2396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 7f2203cfba28d59dcaf740ca8860be92573dbf903a82b2d07afba9628c08a7c3
MD5 98279ad086ee608ab0f1df85367998d7
SHA1 41f29941db249a4eaae440223e68bd5284e175ba
SHA512 9d7472bca123de6b50cd43d6d08e450e26c55a4e6b11801c4bfa55b161c62de94e4fed2ca4859d24b6dd670814d6d7cb295d497d467aff929c42d217eac00a87
TLSH
T1ADE026D813C0F6E4328A978B808AA31C40A173CADA8CDEDA32FAE4DC3881808D380084
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 d4c35b7f3bf5f2229670b0d2c0233313b790217a0b1055fb0d547635076e6bb6
MD5 c8530c344664ce4a7df0a1d2d75b5093
SHA1 60725525063b6e68d1ad0e5be13c7681da559b04
SHA512 11dce854746abd162195309bd56da62cf5afff8c0d2a254f265369435bcba8c04169ee9f725784ef574d6f94131632f904066355d253a17d297829d44c84a72c
TLSH
T19EE026A906C8F2AE9640A54F41AC430C82E1374BA2C86A0A67428CDC34C3040FBC2B9C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 914b4090f38ef4996b9360b11774441533ed4b34ec6be5a282e94c6c827ac87a
MD5 982ba3072fe84dc4dbeb0691bf034809
SHA1 c01c17a8b2e5a3bc7c102b6ab861635756c9a368
SHA512 243d9450aa448b79f7e9793144d7e12bfda12a6a8fd64be0a2e0a35659d2878f74221f9f2c98e8801bd44eaeedf98964721a6a619c01e4f4b45d7e1330d93866
TLSH
T184E0268C23BDF9E905B2962A8054B31C8D00308B938D66997ACB71FC38C300693E3984
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 275B
SHA256 9e070230d6c6c960bacb75a8e2f080ee39646a955224f8a95e9e74d6870aed6d
MD5 723685f37032870a0a6574c995e30f52
SHA1 605b7a3a58391e3e1cb229f16a99e6b0987b079d
SHA512 a2dfa595513b0a7fb872159b7755baee588afc462c499832f9175fba550cf1b1b9b2d8b66bd47d602b89f6a70cd95e8d577679395557e958e9598ad86b70527c
TLSH
T12AD02BEAFD8CD9CFD3D01EBE8762F0000B9595A2881B9B031120FDC13281AF01F26120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 2ecb2d0ee442c6ea66117c74c22b36a601397b35d698ada92c322e05fb0c3daf
MD5 bafe3aba0cdf6172c04acdc87e1b3a89
SHA1 d84fd735f766d35df62790ed707fa414d9384aba
SHA512 df364439abe41ef3d1999e39d28c58460386a255f4f409d412c71848f03efebbd6805daef1218b594a075683deba66b3d12ff8cf5dfb26034b4569a96ec0a4b4
SSDEEP 96:LzaLHyywbO4mvS6au/QqXCy+B07NbDHcYa:LOLSLf+J+US
TLSH
T182916DBE00166879E318C079AAD855B534F2A7EBF1073F1912EF8CFA2ECD3158819178
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe589584.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589584.TMP
Size 3KB
SHA256 d2faf087fd972847e41f55e4af3f0e253f93ec2e6db19c3e9e48f6c3de439dc5
MD5 bf1f0987a1a93879c210abc8e6cf262d
SHA1 5bcb4712d91686f6e659b28a2d9558ca426e9101
SHA512 4275d185ef867b3b8bb0e1a35cbd31e55da3d083b412fb00ffa6919e850498c8a1ea4cbfc9d2946006ddb9feacb314a687c429e973a695b7cc32cac33d1120a7
TLSH
T136714ABE01162079D31080B9A2D805FA39F1ABEBF1163F6910E79DF27E8E3158C1A079
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0ae9aa7c4af0a4085cc60f47eb2499c8db633df56895b345873eb7794546df7a
MD5 a854051983ac0def33321eae2fa35ba6
SHA1 53ec868389220080cc3a78b454c52801938e80cc
SHA512 2b4fa5942e256b005fdd607ea946b8c6763e9cc09eeae049f565aaa1652ad66b3e9087ca5d7f1f24410de21e8aa02f1afb348b30c5365c5ea6ff0844c9440830
TLSH
T15E215AF383B9956E9A2192F4AE049F1BCE5C0412832C796986D46E17A3F3971E044A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 da89665ce110473a8ba39c8044a26b7ffc06edaa5329a50ea852362716a334e2
MD5 0af0f52181d25d59b90ce00236cb0674
SHA1 2ce3ddf65509bd43daff79815f28ead5599ad2a6
SHA512 e37be2b63e066f39c489b35966a114100dff71b9819f722b94a5a489eb94ee4acd8758ad92e7363515bce55e7e17a28cb1dc866cebd4331153eb9d5383973bb7
TLSH
T111318BF383B8456EDA2192F4AE04AF1BCE5C0012832C796986D0AE17A3B3870E045A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 179aec44b3839e73761556d6d96a43f0f0f2ceab14ffa3aec297b9eb1b5ae112
MD5 b24fb5f2c49acbe80428377aa3a07478
SHA1 a1d55f1d664f5d0c58f68c9e49bdb790ab02f00e
SHA512 bf736912f9b178ded4fabb78d012d6efaa85c377c235389353e64fb606749393aa76bebf9a65622b038a92eb9ed5f1b3e02e217a709c2d504e976427c0df2e18
TLSH
T190319DF783F5556EDE2192F4AE046F1BCE5C0412836C796A8AD0AE17A3E3460E041B5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2b51ec68c9449d26e95555fecfa4694b4e337194ac167a6c684944a05304bdf0
MD5 10336d7378ec41d6783b8b5a327ac949
SHA1 4785a71edea17d7f7a9c0f9dd3949f5cdcaa7b4a
SHA512 943f62b3febecf6bab5789c0cf69f1c18ed3e12d84b6f183df15e1f51dee65e372ff634f441779cbe8a0faea9b09f5fbfadd3fa25e5f2a46bc2bba2bdd8bdf0d
SSDEEP 192:sxZlMRXyM/jK1Ml8MkI/fhnsT9DVeIdpjlWHW6+WNemu/Yv3yqdgIgrJ:sxZlM1MI/fhnsT9R8HbW/8u9
TLSH
T1C252E8126A385977CCCBD209FA55BF93D6F9147292941E44AAFCCA0C05E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d361dabba4b3ef72e0b1e17fc3a859fe0e9e1d68742d6e8a7194c47a9b65288c
MD5 c1733abd83627100abb74837094093e1
SHA1 c016237769d908529695fe1848ccb4d72c4a027c
SHA512 5a45c32daa5af95bc60d98c390a4eaa6040cf30bb980a5d2861d606b85fe2dd09bf8970e469b2ff5f9ddda6a0dee2e99a50e5b6688276e556cc8a246b9b397d0
SSDEEP 192:sxZlMRXyM/jK1Ml8UQUkI/fhnsVcDVeIdpRlWHW6+WNemu/Yv4mUdySdgIg5PJ:sxZlM1qvI/fhnsVcRyHbW/NmSu/
TLSH
T1A852E7526A385977CCDBD209FA45BF93D6F9047292901E44AAFCCB0C05F6ADD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 93390931aa60866feb32ba7eb70af5a2ed12360e43a3fbbd9baa933f4515b352
MD5 d082cc9e30c908559fc3c4225bb17bb9
SHA1 18fd2d6a50855e167949d2078e7b5109467aff4c
SHA512 f115b57a453949128c920a010f88c8bffa3f3918122a10f8e29207483d0db7ad686261eebc114d9572835511c21410df40b0d8f9bd5a70906456649ecc9cf3a9
SSDEEP 384:sxZlMkqvI/fhnsV766s8qMpRiYnazAW8pZS15posJWeT+oRyHbW/NmSw/:sNMzvI/fhK74Mnc7WeT+oUHbMVW
TLSH
T184D21805A924C877DEC35D18B47C7E73D9EC40926284DEDA1AECCA0C01AD5FDAB4782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6ffd1022093390284014732a84ce28178a506e52e8e23022e8b1156d93830b11
MD5 84b9d37c83f2ba4f437c70d80eed65b5
SHA1 ddfbbc2ada89c437721cf73ed17a2976edbf8534
SHA512 d30b53a9b56386edd8b43bab5f49e96e8b5b424cd60bda819051aaefb30753db0cf69b3b82a9f54089799e4e40fd38bedfec960962c5c0b1b1348872e6498dbd
SSDEEP 768:O0seJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppkrofZ:O0seJ3xWvhfynu1jaVcL88pvB
TLSH
T151D20B2B280CCB7E4F844E6DEC266F966EE801CB67984D5487EA884C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 1KB
SHA256 6fbe55f54d1abf9197234f4b43e0dcbbc12f8ffff2d4c2fba52185543aff8b45
MD5 e2c0a2332e67eb4680b93c0de26a6301
SHA1 0992ef8f2ffa3bb75f4538d0b9035b4dc6ee5eec
SHA512 160c9f549958b727ccf35a61b86aafd2d71444e325d8560951495f724475d5ce2ac1aed8d1d1795d93f5891a46b156b7154bde92539280d79ecb0125620d35ce
TLSH
T15831444ECE41C59FDDA889B1147664A833F0D9CC1B1162534C3C753A3C673AA2A4B5DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cd885.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5cd885.TMP
Size 1KB
SHA256 d5db092b624ad389db056801d398f75562d9d0fe60b5f374ea81d3175accca0d
MD5 e205a0d836a328269417b6f324dccd3f
SHA1 2d381fe58e462084530c6cf9d7d3ff69536622bd
SHA512 be48b9d1621afbf50c6fc082786b58bcebff0391b45e6c85c0287f227ee9d16a31ec21b7b76501738c262a4458dee7bded956f2b0f0c88e385d0d5e2ede68b3a
TLSH
T12C31938A8A81890FE8E440B20592A4B8337AD84053127383887C62397C357AD1E9F0C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 aed93e83744579f5e97c7eb8760cfa65c77cabd7cdcb25c1ab87e4d860963c39
MD5 ffae1d4d25c395af8157b6af47efd301
SHA1 3c4879b6bf81ca04f972b419f39fc94427fdfb4e
SHA512 f36443533448b7d18c9a8f2c3e2886574bcae4f587cc118fc6d6b169f98fc3f9a9ea5bb682e7318553d3fd99e5b5bf5241ac23824665701260fe56304a96eb9a
TLSH
T1C7E06FB62DD32820BEABC3D220308090064A78ADE901BC0EA42AF68310B2316309AC26
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fa720962d5c3c47063ff6790165de638cfec18cfec7a3fdc367fce8cc947202b
MD5 df9cc8273ba744e37389c91a27ea305b
SHA1 fa7d5bb1579d279bc7b5f2e30e7afb0a6ffd4799
SHA512 b70d87e11432322fe2f276227cf1d4a051c035306d82b9d9f888d5b9b6890bc1a666db01ce61c21ae9b566fda0bde41502d9cd48203f7990b594b4bfff58672a
SSDEEP 48:KYHIhKggkXyhWIPKvKY/y5mIPK/aU9sJw:KYH+KggmSWsKvKqqm4K/ae
TLSH
T1A591F706343B12023DBD254CB2E6A5378E4631E37458B86FBFB814565E26E124EFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aeb78cd5-d0d3-4530-9ffb-d01069d26ef3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aeb78cd5-d0d3-4530-9ffb-d01069d26ef3.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59288d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59288d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 18822b18e01b5bfa5a9ea4c7f040ff7761d6815daace7b1ddaa6cc8cbd8429ce
MD5 870cfbdb76b09add1d9e46df8dd5d048
SHA1 a61ef1f2f136aebb181a8b4cd3c6e8d5f6405deb
SHA512 2db05702fa8a96774c94f767afad73e38aac08a3f4933bbed021bc3161ec0d45a2dc5b43cae712427988c665fc20e6720b604fef383a76d10a0db56f1cea5c50
SSDEEP 384:yiF1tNn/s3n9SOzsNL8TUNTUlIlIDo7TuuBimLmpaX:5F1j+952wglNAmLmpaX
TLSH
T162B2F8F248D7893BE9AE5B47B73D2E164EBCC057B5806A40B7C85A0CCD961BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3109b9fda98f2336a1e5f9c7be367fa5bf23318ae5f980903358eeccf428bcf9
MD5 648965f8e4e46f5c7e30d5c4ffe130b1
SHA1 fa7e177de82f134893aea8785703a331d17d08d0
SHA512 6eb60f10a16917a79ede80a18cfa57d76429e307544280dbadd4ae1a945385d80a215718529aaad971322af600798c940f869fc6ef467a0c9cfd4ae15dd0b8c6
SSDEEP 96:eqONk9QsjpflMoUZre5ih/cIPURHl8h4otop5hODYBjPYvlCr5pgz6qNGebL5Fgb:lON56vMtPQmiUyysThTc/CA8475pWU/u
TLSH
T1FF020935AC785C7BEAA7AD45F48A23271FB4216FA6D05B50EAE82F1C00D764C1307D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 c834e49caeb43f8746a73dc519ee979e064ee72216df0aee6c660b49869e0620
MD5 8398de68022742f7361f7398007c7060
SHA1 9b0878e7de4ca165c29736fea8307cb314d0b9f0
SHA512 14857ad9d8b8a96cd17bd375dae631c7d7b3cd024f8358512ba9857488544ee767054974edce902f7c2c7d47d8af752418a8b8b864b92db0a05347c3300a8880
SSDEEP 192:QONM6vMGPQmiUy+szhTc/CsbLX80IBqsU/u:QONM6UGRMzhmLIpU/u
TLSH
T1D4121976AC689C6FAD97B441F48A32171EB4816BE6C4AB50EADC3F1C01EB65C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 127002936218ca1d1cace7f333c9c4a0b1b339125409bf60cd91ddf80cfc5258
MD5 cf6c8b49f4d0966b8f071e3fa52a078e
SHA1 733c8d0d38493a09b3f7614006c7b70a5669c9fb
SHA512 e1b820259ed4d452673557504f2348f9071eaa52792fd0934809738ca019211995b4f3bf74e2d48d4f173de290ccd6fd0dabe054cf12d16c2e00460e314c038e
SSDEEP 192:udTSNWMsnMcPPQLz3XX9VofsNp3Q6fH7M76YyQmiU1boe4MTc/CsbLy8z1BqsaX:AtNn/s3n9SfsNp3Do7TuSBimLrpaX
TLSH
T11A625C72AC785D2BA9A7A584F44B33175FF8416B96C42F80E5DC7F1C05EB2AC1307A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 35a36e6250760b3b198118e8bb3ae0d944ec062ce3406b14520088f9902ef9af
MD5 f9649a310a77915e07a163f23fdd522e
SHA1 a0fc859729ba9c8a4ee7cfb07c7a4a4ca266bb59
SHA512 9046bbf680d3a84526db9b9275606967a5190269454594a55bd2f22027cd082e0e02e9d48da1f47cb2ea115a18398aa34dfa2bf618899d174049ebcbe9527bc5
SSDEEP 192:u4TSNWMsnMcPPQLz3XX9VofsNpIQ6fH7M76YyQmiU1boe4MTc/CsbLy8z1BqsaX:HtNn/s3n9SfsNpIDo7TuSBimLrpaX
TLSH
T1CC626C72AC785D2BA9A7A584F44A33175FF8816B96C42F80E5DC7F1C01EB29C1307A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4de72d01-a485-4980-86fb-16c8fecc25cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4de72d01-a485-4980-86fb-16c8fecc25cf.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 477de5ae41a36a6a8c5f49937b948feb0d121335b1a1f29ef5e44b27c95d1b68
MD5 0b9af6cc961ec55d00e0cce901930c85
SHA1 e2a0179091ddf3ffc457e7cac419d591decc84cc
SHA512 72ba660dbdde88f676c5a848fcffc2595b5792b8fa9b8bfa7a6ea027912ef2de97d57ea4dfc7f14d5697c8177ec5bd1b5b0c0927f7944b6c1fcde84be0685c39
TLSH
T12341074CBBF91148B3B76E6A9BF2646D447BB9772E06859E10020D4F0A33A41DCB1B37
MD5 SHA1 SHA512 TLSH

Submit Download