hxxps://drive[.]google[.]com/file/d/1nW8Ld6D3B7nL163NXHQTv13pDHFfY59N/view?usp=sharing

Analysis

user interaction
yes
max time kernel
898s
max time network
889s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 08:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://drive.google.com/file/d/1nW8Ld6D3B7nL163NXHQTv13pDHFfY59N/view?usp=sharing
Sample260727-j9yllayfph

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	drive.google.com
8	drive.google.com
23	drive.google.com
25	drive.google.com
46	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2080	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296141898399861"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{3AE6BD5B-5F45-4418-B455-2AE1D7272B88}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1268	msedge.exe
1268	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2736	1932	msedge.exe	84
PID 1932 wrote to memory of 2080	1932	msedge.exe	85
PID 1932 wrote to memory of 4580	1932	msedge.exe	86
PID 1932 wrote to memory of 4580	1932	msedge.exe	86
PID 1932 wrote to memory of 4580	1932	msedge.exe	86
PID 1932 wrote to memory of 1132	1932	msedge.exe	87
PID 1932 wrote to memory of 1132	1932	msedge.exe	87
PID 1932 wrote to memory of 3060	1932	msedge.exe	88
PID 1932 wrote to memory of 1928	1932	msedge.exe	89
PID 1932 wrote to memory of 3060	1932	msedge.exe	88
PID 1932 wrote to memory of 3060	1932	msedge.exe	88
PID 1932 wrote to memory of 1928	1932	msedge.exe	89
PID 1932 wrote to memory of 1928	1932	msedge.exe	89
PID 1932 wrote to memory of 5100	1932	msedge.exe	90
PID 1932 wrote to memory of 968	1932	msedge.exe	91
PID 1932 wrote to memory of 5100	1932	msedge.exe	90
PID 1932 wrote to memory of 5100	1932	msedge.exe	90
PID 1932 wrote to memory of 968	1932	msedge.exe	91
PID 1932 wrote to memory of 968	1932	msedge.exe	91
PID 1932 wrote to memory of 3276	1932	msedge.exe	97
PID 1932 wrote to memory of 4692	1932	msedge.exe	98
PID 1932 wrote to memory of 3276	1932	msedge.exe	97
PID 1932 wrote to memory of 4692	1932	msedge.exe	98
PID 1932 wrote to memory of 1768	1932	msedge.exe	100
PID 1932 wrote to memory of 2600	1932	msedge.exe	113
PID 1932 wrote to memory of 3140	1932	msedge.exe	114
PID 1932 wrote to memory of 1548	1932	msedge.exe	115
PID 1932 wrote to memory of 4828	1932	msedge.exe	122
PID 1932 wrote to memory of 4828	1932	msedge.exe	122
PID 1932 wrote to memory of 3828	1932	msedge.exe	124
PID 1932 wrote to memory of 3828	1932	msedge.exe	124
PID 1932 wrote to memory of 2916	1932	msedge.exe	126
PID 1932 wrote to memory of 2916	1932	msedge.exe	126
PID 1932 wrote to memory of 1268	1932	msedge.exe	128
PID 1932 wrote to memory of 5024	1932	msedge.exe	129
PID 1932 wrote to memory of 5024	1932	msedge.exe	129
PID 1932 wrote to memory of 3444	1932	msedge.exe	130
PID 1932 wrote to memory of 3444	1932	msedge.exe	130
PID 1932 wrote to memory of 1884	1932	msedge.exe	131
PID 1932 wrote to memory of 1884	1932	msedge.exe	131
PID 1932 wrote to memory of 5092	1932	msedge.exe	134
PID 1932 wrote to memory of 5092	1932	msedge.exe	134
PID 1932 wrote to memory of 960	1932	msedge.exe	135
PID 1932 wrote to memory of 960	1932	msedge.exe	135
PID 1932 wrote to memory of 1816	1932	msedge.exe	136
PID 1932 wrote to memory of 1816	1932	msedge.exe	136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1nW8Ld6D3B7nL163NXHQTv13pDHFfY59N/view?usp=sharing
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x258,0x7ffce555c188,0x7ffce555c194,0x7ffce555c1a0
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,4186617965058355342,99381837876652461,524288 --field-trial-handle=2256,i,4846583364283088960,15301647457473355182,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1860,i,16928980482857535408,3636139732024357591,262144 --field-trial-handle=2256,i,4846583364283088960,15301647457473355182,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,9636359912569354216,2053038482752551014,524288 --field-trial-handle=2256,i,4846583364283088960,15301647457473355182,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,13545926359559378727,275862812278295636,2097152 --field-trial-handle=2256,i,4846583364283088960,15301647457473355182,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,7651551828202961357,7330772010973644814,2097152 --field-trial-handle=2256,i,4846583364283088960,15301647457473355182,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,6204966494249023459,4310175086501227450,2097152 --field-trial-handle=2256,i,4846583364283088960,15301647457473355182,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,16030720748587659933,13853243969534203778,2097152 --field-trial-handle=2256,i,4846583364283088960,15301647457473355182,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,2896621181982048427,11393762737314416050,524288 --field-trial-handle=2256,i,4846583364283088960,15301647457473355182,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,13670089518260151491,1423010686435440669,524288 --field-trial-handle=2256,i,4846583364283088960,15301647457473355182,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,15925457385277498859,1092469277647316266,524288 --field-trial-handle=2256,i,4846583364283088960,15301647457473355182,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,15925457385277498859,1092469277647316266,524288 --field-trial-handle=2256,i,4846583364283088960,15301647457473355182,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,1150717819843797968,4426702705548510236,524288 --field-trial-handle=2256,i,4846583364283088960,15301647457473355182,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,15801234160935484077,13210155133094086877,524288 --field-trial-handle=2256,i,4846583364283088960,15301647457473355182,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,1912386890540915043,5821619189866856833,524288 --field-trial-handle=2256,i,4846583364283088960,15301647457473355182,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2196,i,486512694236881625,694732493672405671,524288 --field-trial-handle=2256,i,4846583364283088960,15301647457473355182,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1068,i,5842575992794862073,17316233440048822862,524288 --field-trial-handle=2256,i,4846583364283088960,15301647457473355182,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,9400592052325783336,3333173293161933193,524288 --field-trial-handle=2256,i,4846583364283088960,15301647457473355182,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5840,i,13950367129504243127,13836645906152442866,262144 --field-trial-handle=2256,i,4846583364283088960,15301647457473355182,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1316,i,6324694239600371256,17874421932092261063,524288 --field-trial-handle=2256,i,4846583364283088960,15301647457473355182,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,6243355273559847872,5190462877675964384,524288 --field-trial-handle=2256,i,4846583364283088960,15301647457473355182,262144 --variations-seed-version --mojo-platform-channel-handle=1068 /prefetch:8
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,13979173335026911580,6794565499040993367,524288 --field-trial-handle=2256,i,4846583364283088960,15301647457473355182,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,16154828297723372466,11310440135577985213,524288 --field-trial-handle=2256,i,4846583364283088960,15301647457473355182,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,2344674820108019161,15630524667888570450,524288 --field-trial-handle=2256,i,4846583364283088960,15301647457473355182,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,9849318206492522260,11830235523038853453,524288 --field-trial-handle=2256,i,4846583364283088960,15301647457473355182,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:1816

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:64

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

33002377-c897-4a9a-898f-81a74e1c2de7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\33002377-c897-4a9a-898f-81a74e1c2de7.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c593d3e2f5182e0fe598ff02f098bee659149f8294f03f968884e50e90ebc9d8
MD5 ca0a468388e83787a69f6caeb3e2e871
SHA1 ae37516b570ccef64bdb09035323c432580e473b
SHA512 1ece652551ee108158dfc761c1525805a6237eae2a8b17c0022d9a957e142ca1d86f414560bedcdaf628bebca1204e8af2f313800fe2a3d693e06e28072479f7
TLSH
T159E07DB504CCC22FA2106487417C630C9281370AD3CC6A9A770C84C9B401440FFE2690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 8c57ab54be2a2048890ae3f5f7b5a3f18b30b230dceaad54b3b6c67ca7b6bc0c
MD5 a44e40c084528e3bbbdc9022a8f14236
SHA1 260ce53defd845f34258d00b7d3ebb355d7ea5fd
SHA512 75458d8155ae8f161f477f8b3df14714da1fa9a5269227cbdcddbead0374ba3076ba41f85cee42026714ba87b68a0b1ddde22c64cecdac72a290639949f4179f
TLSH
T12FE026E644CCC26FA211A8874ABC430C9280371A97C86A9AB7188C8CF442454EFE7A90
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c018545497309bc2fa478db28fdecfbdbd579feef6c65992f8d53df7d0463d98
MD5 a040f66e9ec5d7ab1639db4b7d70767a
SHA1 d57df7a6a7c398e86071fd1302dbe45096096dd5
SHA512 7f5719ddf89d0de556ba43d88f91cc1c56f9cf44adc9ab74f76c28dd4a3cf7e2b40664cef22deaf17104562f124f02497b39d0188459e94fe5a0714e187e9adb
TLSH
T143E026C508CCC23FA21864C75978430CC3803F0B92CC79DA67AC84887603450EFE6690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 9af067bf348b7affed10eb8341b06e4ef5dc0c6d3a548a516b83f5636af2e546
MD5 3b04f99b40bc16a8590e1b2b82bb8109
SHA1 f99a7f57b2b6ef746e77be8244559f6868aac9d0
SHA512 984e32c70362e83daef852db6f86ecabe318f1723119ab87d2e77d1b2a0c3b8efaf977f3870a7f5722c9da033af927f3bcd4927cfd050e07e4586421fa3e3231
TLSH
T1BFE07D8604C8C22FF340644741EC534C83823B1FD3C86D9B7748848C75018C4FFE6690
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7648fcd2a348c70d7bfadd9c078cf22864c07f4935acc0f52e02709d6acb0518
MD5 10c84a92232efb59e10c83f703d0c6d9
SHA1 ad163f69cba1300f7da23ee6b01a01702d7dfbbe
SHA512 b086607557225d4d628c4333df37174a8717097639aa6340eb203cddaed5928e1bfcab610441b3ca5e87bb8d40de1761def44c5ee580cfbfb016deddb92d2c64
TLSH
T164815F371582C1D4E31A32B0A1E0B3543EB98DFDF1434E9648EC587522A9BAF4277E28
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 9930af8cfd94ec1aad3d0ed46bb7048a412872a0dc75e8b6d78140e25c80b5c1
MD5 b5a43cf2868a804c2c41bcec9dbed8d5
SHA1 f9b99d0e0917a860eb219cd6537f92c1d3003c48
SHA512 91b418190ef5098350570fa12038ab7a4c7951881c2db8bca2cad16554705e0702386763690097f36629c8536dde9e6b23789fd63964b1527f82d1d92cc8e175
SSDEEP 192:DhNiWI2CZLH2KlAes0FqQD0Ow3Ex13Hm/9:DhNiWI2CZLH2KlAes0FqQD0Ow3Ex1Xm1
TLSH
T1FFD179F7C3D9862DC94116F49B15AF1FCE291A18432C3D26C8D8AE5BE3E2431D21A65E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 9b23a1962b065fd1f719a63d21bd3e0091cce199282a4bb3d72793abea8ec143
MD5 f03c9d4eb9c3e479de433eb37b9c507d
SHA1 56ca5aa666292f92c26f7ec0557e000f58882d77
SHA512 c3695173d4e68cc38f0e02ad70b5157d6c95080f5d5c60d0d1c185db2a8a641e8ff01a5acba96d2e8db1e9d889adcc7dc073a0b8aa32d829ba10ffadeacb299c
SSDEEP 96:D/OZntVWUvBZjYBXzcPusq0BIRZZWZemwBj4/yH9:DWZntVWUvBZjYBXAPusqQIRZZWZemkjJ
TLSH
T160B168F783A5822DC91196F4DB05EF1FCE291618431C397A88D4BE67D3E2432E11A76E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 516cfab213e552a0db5552c7b4fa2ea0e7f196c70bb3cf1677b4df7c21962ff2
MD5 394b9ff6c7c85b328cb4e2531587aec7
SHA1 c951be66c4985ff5a944fa710aa57ae184e9ebb7
SHA512 fbc93f8d6ebb71ecbc5de4b53be66e3a0b367b395fdf1748667c0af5fc660f7e33dcc617b75afb88dbb188b136eb78c9b56ba4f73f3004b7eb73ab53da2a4dc1
SSDEEP 96:D/OZntVWUvBZjYlZzcPusq0BIRZZWZemwBj4/yx9:DWZntVWUvBZjYlZAPusqQIRZZWZemkjn
TLSH
T16DA169FB83A5822DC91196F4DB05EF1FCE291618431C397688D4BE67D3E2432E11A76E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 25KB
SHA256 ab52619c73e4cff14700dda50947e197f0fe1051a802f6d7569ecbafc220ded1
MD5 bc34d0f8456afd74c6c7badca019d2ec
SHA1 3e7c4cfdc6303ace339f46e6c2ce2cb9b91e2a02
SHA512 e67623e90f6226e3ab7cacdb832da18291b44d6e704348e077fb723f6435de282b7784c5312a35e033ef8dfb876ead62d199de4268fba80fc15fce19154874b0
SSDEEP 384:sxZZ7Z/fRs7v66s8qMpRiYnazAW8pZS15posJWeT+0L9HbB/ssV:sR7Z/fqv4Mnc7WeT+0ZHb1so
TLSH
T197C21806A924C8379FC35D18683D7E33AAEC506262C5CEDA16FCCA1C019D1FDAB4B857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 48b5d23bddc2ab758cca691253773bfdad95df42a785a7b9a6ad9970371d9ee9
MD5 52196080b896d131fcf4d882c0792698
SHA1 3ad89e8cfaed3419a52fc713e90c5a296890631a
SHA512 6ac72c635cfd88e344e5814f6a5c210fe9179e3afeaa217f8922bd70dd9b3c312ea3679297d1346be5b143b59a819662a04ad5f592b0094bf10ed9cbbdb71399
SSDEEP 192:sxZZRCkZ/fRs7ekiIdp7PHW6+WNyVK/YCD2OVdIg5dJ:sxZZ7Z/fRs7rL7HbB/vXV
TLSH
T14332D8266E7899778CCBD219BA15BF13E6F9503291951E48E6FCC72C05E6ACD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a83ee3c45ce16528e6fbea3a8e2a7ada113fad5a39c89a51d5a18fdc1b4b9209
MD5 ec584b40cbc4071e95d872817b7433a0
SHA1 07d2db44e2065d539af8c6d3f6681f9d7b6e4d7b
SHA512 5cc136b0e20cdee55d96730e671f93e0c53cf991af6ab21da5909bb06d51345e007746c9a005a4c716d3267424c93b661ea3403153be4b6c8e3f2f593bee1ddd
SSDEEP 192:sxZZRCkZ/fRs9CkiIdp7PHW6+WNyVK/YC1wOVdIgrJ:sxZZ7Z/fRs9HL7HbB/LX9
TLSH
T19F22C9166E7899778CCBD219BA15BF13D6F9503291D51E48E6FCC62C04E6ADD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 97d26a61a38f9b4526e24b7214da9f247983f6087cf94834aa6f2c098c815603
MD5 1a3a3133347deac321892fba66da2ec4
SHA1 c5447a2316c1d1b88c493cee8e9cd36490e2edd1
SHA512 d9d19a3d80184bb0a68eca2eef00777c542a78cd6d10d02dd87e587c5e3d15102e992cb63349926e6b4ca99d183583ce908a2421d19f2b6797f7012f54acf576
SSDEEP 192:sxZZRCkZ/fRs7CkiIdp7PHW6+WNyVK/YC1wOVdIg5/J:sxZZ7Z/fRs7HL7HbB/LXj
TLSH
T16722C8166E78997B8CCBD219BA15BF13E6F9503291D51E48E6FCC62C04E6ADD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 8e40444ba7419d089dc87e67b7b71476cbec5f233cb2715b362551782f3d4b89
MD5 670387d3567f96fbe7520499a57c9f4b
SHA1 a1bcd98198514442e69744bfecf8ba52b5281bef
SHA512 ad8b17cf6cd3dd2b2d12008319e14126953f9219f3140b3dd28375c4e3c740d82448f3c4ea18b43558b900de92bd2a77b397808335097a364498dec8a59bd534
SSDEEP 768:QIqbUj+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKrbroC:QIqbUj+WvSCs6u1jaaZLbWroC
TLSH
T14FC2E83B340CCA7E4F801A9DDD5A6F972EA802C7A7588D4447FA994C02C77EA512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
Size 600B
SHA256 0e9867f6c024d4bebd06894eea65266aefa2d2ce5ac3a85de43731b6f67107cb
MD5 9d93322a284cba06c32ba46428f6b687
SHA1 476d504fd2652badc8a61b8cf31fd4b6f4a38e4c
SHA512 e1bc8c427def30faa0711fe3b4419dba7a803ae431d6a604403853e24f27ac0cd7a5226048a64347693c7b82c05e25c7f8be57ae519f4affe2e918deadc30c07
TLSH
T1D5F0D5440EE24826EE918AB224F500F432B0CEECB325C8A3502C2A2A2C2A34829260C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cf842.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index~RFe5cf842.TMP
Size 600B
SHA256 f33268e92b198d659e788cad80e60a06407c17dfa14d4b1c74142792eefaaab7
MD5 d9a3e21b702c85159f83808cb82014d3
SHA1 27e056c928b45e2e80bf7892ca13ac6129a3fbde
SHA512 83390ed0365c0c6e418bedb2c3fcbb3fa185f125e104c09292bd8849792cad2341f79a1e51731e155ffcd9fa04f1f3669acd410c4ea3e67248b579b7dd5419b9
TLSH
T154F0AB8687E29967E9541AB619E940B5B2B0CD107232E5A35069682E2C367C8A5120C9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 60657eb37b15e979190204e68ceff449e06ea08f6262b80ff84ae5cfc38e5464
MD5 563d6fd96647df8ae1505577b8d0fbaa
SHA1 b4171e83e08a04a393d99c7246421d9e4b137705
SHA512 5adec88a5d2b4dc54750b5fd3c076a6877184a8d53a78932cf23b653684c30f4bbc955d5b767de23ee62d9863c8b875b3b768edf8d4aa522fda7b2c929e3f949
TLSH
T1ABE0C0FA2DE72860BC7BE3F5247008E002597988CD86BC8F106AA1D750F3362385AC61
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e1dc299eef46d66ddef18029e6f01d7967c71ac45b8f14d3439f478e2bb8119f
MD5 c8b78ec22228e4dde955024f0572ed42
SHA1 8754240d2e388d864c54b039fc7febc758a2ba4f
SHA512 7401446897217652ce05b26b9103d755b64c4ba05a00923fd09a712c6b83c0a2b725a03b4ce0b463087d702d7f68be57bd38cfb691764ffe0e3389cae64c828a
SSDEEP 48:KIWjcwWsMxhQRsIGIxKz4L2xfOhEJIMSyF5IZKiM8WkI/K1Wcnyx4:KwzuKsou256KiMpkwK1Wei4
TLSH
T1A0A1A6097076A25138BD2449A297BD668FC13073321CA5EFBBB951A70E26F560CFD8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5941c2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5941c2.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2b9c690eec608183c2279d76a5f3b091a9f34706f2af702cd986facacf55b49e
MD5 e8f368ccbeb1d74b11540aa660478bd6
SHA1 306a481331f8e4552d1a540a2ce923a5e3e89ba7
SHA512 c7f0f0298bee2cd9cbec75eda596eee72b0a224129189bbf90714a7298947725b61afc0b938820fd588dac1c96eea96f28a4f9b8ee796108f29aef65e4c2987a
SSDEEP 384:liFiZcIJzsNr8TUNTUlIlZD6aTdOEa+sOk+cD38OObjI9G6w7gS:sFQpOwgHdNaZOkV7829MgS
TLSH
T1C7D229F248E78976D96E5B13A77E2D134EBCD027F5856A50B3C89A0CCC964BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 9a7df3325be03a76031a524322bfa0ff66909696992c90b69e105cf6986f3082
MD5 cb1b68408d8db4437b63f5ce7c477b91
SHA1 922ec77bd5a3b16282d3d69740c1e8b10b6ec217
SHA512 0b7f5b9e43aea192c1f20ea1c7470d83dd1c1ad36730fafa7d24bd6a1ac4bd692929cdbc1da8b6fe7b436b34d6d3d855764ff546caefe842ce9bcc23ad965fcb
SSDEEP 384:lZcIhsNJZD6a+dOEa+sOk+cDG8OObjI9G6w7gS:dhXdNaZOkV6829MgS
TLSH
T138928E335C385D7699A6A511F88B3A139EF86037D7992F50E1DCAF0D05EB9AC130782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c2c5e7b3e7c2fc623dabdad9f7831488c5f0943930c153ef57d7d0058e4290a5
MD5 702a6a528c5cea8ebb5487369596aa75
SHA1 2f28fc35896bdfd4ce92b00d6ab8ef07a2828241
SHA512 4b84c3a6f3a0e40e54092198dce63dd17604e898d1b2a7959b942dd3f212325ebd0635b8eb8fe6a1dd7eb613a07de259b44558b1ee34217cb21df8737de9d1ad
SSDEEP 384:IZcIhsNJ+D6a+dOEa+sOk+cDG8OObjI9G6w7gS:2hQdNaZOkV6829MgS
TLSH
T166928E335C385D7699A6A511F48B3A139FF86037D7D92B50E1DCAF0C05EB9AC130782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7933a5d417c229f5cced8fe84d68d87556af266eee39ef85da54573557f5152c
MD5 1f95609f5806fa8c27619e44a02fc250
SHA1 dd96b44ac34103b5d77b9489be4f8a0191617dc8
SHA512 39c13f203eb7188bd1ce80cb5cd19d50f8cda5de3ee011b0e7c8fe1601b6f37fc97e549435bbfc2a1a3b27ca96586c7f3e3f9397c79af5e027b04fa6c7c0fa73
SSDEEP 192:vON16Db6QmiUyoUJHBa+jYOmeW+EKRgpwU6:vON16umJHBa+sOk+MWU6
TLSH
T1FB02E83569785CB79EA26E45F88B37279F94203BD9566B94DAD80F0C00D765C230B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c988db5583dbe82de254c7cfc0db157efe11d5fe37221bfc9e1bfcd3c1f97ae5
MD5 f47cb97a52d76d8d898e8da2bc4331f0
SHA1 3ac0ea17737ae1349e4ec7f658e8824c103dd574
SHA512 d9bd6c587c58d42ab75ffca6e1ab22d7c8400f9e5df0951176aea56c906684b44a2ea93ddff1a5eb8295a3261c734e0e30409186e816259a49f897d82db716e4
SSDEEP 192:XkONs6Db5QmiUyoUJqBa+jYOmeW+E/0e4SlNzBqtU6:0ONs6PoJqBa+sOk+cDb8U6
TLSH
T1C7122936687C5C775DD2A944F88B36239EA85127DA4A7F90D6DC2F0C01EFA9C130B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

39054488-9366-4c67-84cb-fb9142467f80.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\39054488-9366-4c67-84cb-fb9142467f80.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5a823ce0df98552e665010089c482b6f1b2d70f14e1c9fddad7ce713a12787c0
MD5 b6b0772986a85c704128146fa17b412a
SHA1 7729d0b37465485684f345515799303195c50058
SHA512 6a45046525129e481ad061c8bb07423f01ff8a239e3b7e74f50eba5859d349bc9aa28279f2f8d6706d2eac296ebda4fdfaef07d34c89b63b6fd44274a2d18735
TLSH
T14341FA59A6F91108F3B76E5A9BF6A86E487E7D672E06D46D00110E4F0A62B40CC62B37
MD5 SHA1 SHA512 TLSH

Submit Download