hxxps://drive[.]google[.]com/file/d/1xDsWD6t23Gh83f_JeF9erEt2bJGi3r2i/view?usp=drivesdk

Resubmissions

28/07/2026, 16:48

260728-vbk4dsac866

28/07/2026, 16:45

260728-t9g9qacp9w7

28/07/2026, 16:42

260728-t7rqda1ygx6

Analysis

user interaction
yes
max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://drive.google.com/file/d/1xDsWD6t23Gh83f_JeF9erEt2bJGi3r2i/view?usp=drivesdk
Sample260728-vbk4dsac86

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	drive.google.com
4	drive.google.com
12	drive.google.com
17	drive.google.com
56	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4968	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297309456750767"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{89F63DD9-AD90-44FE-B6F9-719B2FFDBF44}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
864	msedge.exe
864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 3680	1660	msedge.exe	83
PID 1660 wrote to memory of 4968	1660	msedge.exe	84
PID 1660 wrote to memory of 4744	1660	msedge.exe	85
PID 1660 wrote to memory of 4744	1660	msedge.exe	85
PID 1660 wrote to memory of 1636	1660	msedge.exe	86
PID 1660 wrote to memory of 1636	1660	msedge.exe	86
PID 1660 wrote to memory of 1636	1660	msedge.exe	86
PID 1660 wrote to memory of 4992	1660	msedge.exe	87
PID 1660 wrote to memory of 4992	1660	msedge.exe	87
PID 1660 wrote to memory of 3948	1660	msedge.exe	88
PID 1660 wrote to memory of 4992	1660	msedge.exe	87
PID 1660 wrote to memory of 3948	1660	msedge.exe	88
PID 1660 wrote to memory of 3948	1660	msedge.exe	88
PID 1660 wrote to memory of 1964	1660	msedge.exe	90
PID 1660 wrote to memory of 3272	1660	msedge.exe	91
PID 1660 wrote to memory of 1964	1660	msedge.exe	90
PID 1660 wrote to memory of 1964	1660	msedge.exe	90
PID 1660 wrote to memory of 3272	1660	msedge.exe	91
PID 1660 wrote to memory of 3272	1660	msedge.exe	91
PID 1660 wrote to memory of 1412	1660	msedge.exe	95
PID 1660 wrote to memory of 4804	1660	msedge.exe	96
PID 1660 wrote to memory of 1412	1660	msedge.exe	95
PID 1660 wrote to memory of 4804	1660	msedge.exe	96
PID 1660 wrote to memory of 4736	1660	msedge.exe	98
PID 1660 wrote to memory of 1836	1660	msedge.exe	99
PID 1660 wrote to memory of 1836	1660	msedge.exe	99
PID 1660 wrote to memory of 1836	1660	msedge.exe	99
PID 1660 wrote to memory of 3020	1660	msedge.exe	110
PID 1660 wrote to memory of 4864	1660	msedge.exe	111
PID 1660 wrote to memory of 3864	1660	msedge.exe	112
PID 1660 wrote to memory of 4740	1660	msedge.exe	118
PID 1660 wrote to memory of 4740	1660	msedge.exe	118
PID 1660 wrote to memory of 456	1660	msedge.exe	120
PID 1660 wrote to memory of 456	1660	msedge.exe	120
PID 1660 wrote to memory of 4832	1660	msedge.exe	121
PID 1660 wrote to memory of 4832	1660	msedge.exe	121
PID 1660 wrote to memory of 4832	1660	msedge.exe	121
PID 1660 wrote to memory of 3376	1660	msedge.exe	122
PID 1660 wrote to memory of 3376	1660	msedge.exe	122
PID 1660 wrote to memory of 2160	1660	msedge.exe	124
PID 1660 wrote to memory of 1892	1660	msedge.exe	125
PID 1660 wrote to memory of 1892	1660	msedge.exe	125
PID 1660 wrote to memory of 1892	1660	msedge.exe	125
PID 1660 wrote to memory of 2392	1660	msedge.exe	128
PID 1660 wrote to memory of 2392	1660	msedge.exe	128
PID 1660 wrote to memory of 2392	1660	msedge.exe	128
PID 1660 wrote to memory of 864	1660	msedge.exe	129
PID 1660 wrote to memory of 968	1660	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1xDsWD6t23Gh83f_JeF9erEt2bJGi3r2i/view?usp=drivesdk
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc4dd8c188,0x7ffc4dd8c194,0x7ffc4dd8c1a0
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,3071603452888128842,4262622666040565435,524288 --field-trial-handle=2436,i,17016811265516448743,1366595627324386442,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,12621782732655110856,9769867983159701956,524288 --field-trial-handle=2436,i,17016811265516448743,1366595627324386442,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,9036489372348857451,17690093048660454687,262144 --field-trial-handle=2436,i,17016811265516448743,1366595627324386442,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:2
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,10199017401831431157,14105942418038460611,2097152 --field-trial-handle=2436,i,17016811265516448743,1366595627324386442,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,15791190805343799674,15245009181429995258,2097152 --field-trial-handle=2436,i,17016811265516448743,1366595627324386442,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,9256200658867995618,12569688025019926338,2097152 --field-trial-handle=2436,i,17016811265516448743,1366595627324386442,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,13293649688389998349,10769786636107626782,2097152 --field-trial-handle=2436,i,17016811265516448743,1366595627324386442,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,8179919254817945661,16023678740753681243,524288 --field-trial-handle=2436,i,17016811265516448743,1366595627324386442,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,4487485997239354577,3870164756520280769,524288 --field-trial-handle=2436,i,17016811265516448743,1366595627324386442,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,5728921590946332107,4013773040387131523,524288 --field-trial-handle=2436,i,17016811265516448743,1366595627324386442,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,5728921590946332107,4013773040387131523,524288 --field-trial-handle=2436,i,17016811265516448743,1366595627324386442,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6220,i,1668200620053128739,8115293925659593801,2097152 --field-trial-handle=2436,i,17016811265516448743,1366595627324386442,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,4660814485404102229,15444630757305758037,524288 --field-trial-handle=2436,i,17016811265516448743,1366595627324386442,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,8101302206502433784,1956453163156130500,524288 --field-trial-handle=2436,i,17016811265516448743,1366595627324386442,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,16056311428611151761,5003674291452648188,524288 --field-trial-handle=2436,i,17016811265516448743,1366595627324386442,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2984,i,9079340022426949862,4855015024339597715,524288 --field-trial-handle=2436,i,17016811265516448743,1366595627324386442,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,15436865860871392077,12440082557086840141,524288 --field-trial-handle=2436,i,17016811265516448743,1366595627324386442,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6592,i,9375233037520878470,9536470017687805748,2097152 --field-trial-handle=2436,i,17016811265516448743,1366595627324386442,262144 --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,7257028753007674871,9504666495516604796,524288 --field-trial-handle=2436,i,17016811265516448743,1366595627324386442,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,16077113127368147038,8311642289176662825,524288 --field-trial-handle=2436,i,17016811265516448743,1366595627324386442,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,16077113127368147038,8311642289176662825,524288 --field-trial-handle=2436,i,17016811265516448743,1366595627324386442,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6628,i,10143139976575256027,17319687272490244395,2097152 --field-trial-handle=2436,i,17016811265516448743,1366595627324386442,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6492,i,12745450080415769081,18118475516171341855,2097152 --field-trial-handle=2436,i,17016811265516448743,1366595627324386442,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6972,i,16217535478613058775,9905257405649257869,262144 --field-trial-handle=2436,i,17016811265516448743,1366595627324386442,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,1025093470049121228,3502861026051599021,524288 --field-trial-handle=2436,i,17016811265516448743,1366595627324386442,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 340f10b1b38491acae959f3da562d13fcd5cc099458d02bbe0f83f35729c48d9
MD5 bb71f2fe8e13f3153d632bebe892db14
SHA1 f48b1af43ac08c4f0803ef17e7ed0fe42bc213d1
SHA512 d3ff62927ff6aafd494564ed9e24bf03c85d3eb1a5bb8e187428f98934b276ff8d9e964eedf795ee64b2d048c282a9da74afb11ee68de51306e8a369019671c3
TLSH
T17181B356E5613084E32D4239FAE37AD232B04C9D96C38E9171909E7F67537EA1406DC7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c186.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c186.TMP
Size 3KB
SHA256 71fe3ce40f554877438dd04612238447a5aec12443f1812b71487910c92e2c4d
MD5 e9c985dd1cbc76f271d4c19e9676f56b
SHA1 469b8883995c5fd64221a4eab14a194572fffed2
SHA512 7df76e47fcd5d8b244b44b571e2d6e3ac56ead4ef08b01c4309879fc1ea44366dd032bebb6fa41096835eb9b4550ccc9b3e299793fb99f31e8ae804fe40fa222
TLSH
T1A5717056B6A13490E32E8239F8D336D133B18CAE96C39E9132905C7F67177E0140ADDB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 d2e61614bd08ba17a41dc0837a80a3b0d742f513a3293a61005778039627fedc
MD5 e73fc42f8abdfb912e5235a707eefea7
SHA1 4384b68e4ff0e87fb6a516d3957dfd32e83813cc
SHA512 485e54f5bf3f081a0447d779f953f55273193b40563b188d3eba2757e824e75356fd1f4ad65293fc538a117831b390caa0fcf919bd025f07963b2166acfc1e46
SSDEEP 192:DtcTVSPT9lGi59evY+qpuElv6xZs9jmvdKbr:DtcTVSPT9lGi59evY+qpuElv6xZs9jmu
TLSH
T114E199F7C7D9822DC94116F4DB11AF1FCE2A1618432C3C26C8D9AE5BA3E2431E21925F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8244487236d67e631f7651a94ecf958dbdaac3971113b59ef61e770de852a4f4
MD5 51f12dee358a2e13b879da52a1dd0d0a
SHA1 bfd4a4f2d08c133b74043b57e384e7390016585c
SHA512 b1cdf08593f09f29b0df1da8659a54c738c5de6d8c3c97b04666675b590c3825be381640fa076e6e763389f074ad99ed5d0915ba1e137f50ceb7f034e5d96086
SSDEEP 192:sxZiR9yM/jK1Ml8UQS9a/fVs4vOGIdpJ6UgcHW6+WNyOTV6x/YHJAwjEIg5HJ:sxZivqka/fVsoOnYEHbry/7T
TLSH
T1B762C957AA3859B7CCDBD209F9557B57E6F51872E2940E44A9FCCA0C00E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3ce1861343663efc82f5ac7c83918781e40584da39f6d7a754d9e77ce3783457
MD5 efd7d24036d7496c2fbea225991de423
SHA1 84e51e73f0cde3d96d07b509eb35d82561441e28
SHA512 23c9e57377f8c8329bcc92fd70bfa4ebfd790e484e50bb362df098360b4a9af76fc5847dc2e531c4a0116aafee925c724da378a82241586c0ea9929787cf929f
SSDEEP 192:sxZiR9yM/jK1Ml8Mka/fVsbvKGIdpJgcHW6+WNyOT/YHft/jEIgrJ:sxZivMa/fVsLKnvHbr//9
TLSH
T1F352D916AA385977CCDBD209F955BB53D6F50872E2940E44A9FCCA0C04E6BED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 cee7a114478661b19ad7310d847027fe4fed7fdfb77b78db0cf21b8e9cca8a88
MD5 b24ca78d8a61373e656c98812f7aa579
SHA1 58664ab9d6a885da969c78cbcf6819466cd4a42a
SHA512 34c95f00c83f7bbbe81394da8ca44d53f39fb791cf6afb253991dd0995529b3e564d7706a42d56cd0b2ce4901570ef8a2896e0830982c961a7593db0fe8479d5
SSDEEP 192:sxZiR9yM/jK1Ml8M9a/fVs4vOGIdpJ6UgcHW6+WNyOTVuC/YH5A/jEIg5HJ:sxZiv1a/fVsoOnYEHbr5/8T
TLSH
T14152B757AA389AB7CCDBD209F555BB57E6F51472D2940E44A9FC8A0C00E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a1606ad495638afc312193fb4dc7b50f7e639aa17f09bb3705bc6d7269c449a3
MD5 8c318095156d5fcfd634c04a2d98cf64
SHA1 9a1a20b6ca94440dd8b92f8ed9178ab27291dd79
SHA512 b3231de2f6e9e932d74c25c8d74bd34ff51914743e94274ac466d14153ec2fb2492172a3ed788b5d112405e1c65b5c5da2f0bd61cde52479bf11bc4460074750
SSDEEP 768:epUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4R5roVB0t:epUZYTMWvg0Pou1ja7eLZmRyQt
TLSH
T1E4D20B3B680CCB7E4F844E9DEC2A6F963ED801CB5A584D5447EA894C03CB2EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 176a800681c7c098ca9fbb61a5aa77483b702936fabcdac763d74a9c06c158a1
MD5 0206f01073e44891df5862cd15cf761c
SHA1 8dc4d4c2f61f20a14981c9006d4afff9c606e349
SHA512 fd01213195709f62e128abe698d8237d813247cf20c602fdb0ad0277a843d821890e4c28399958abe51ed22f6761ce28ec4972d7a20cbc7cec4b7c101068e88e
SSDEEP 192:ERRKNx7Dz4DExxBTz30pR8nRnXkXNizuS8w0hwl2qWBOUxySF88:EW3kdizuS8w0hwl2qWBOUxySF88
TLSH
T19ED1171270B70A013DBE2B0DA29587660741B2637019742BBFE840B65E6FE385DFE9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a12112e5dbf9f65a25b672bfcf51f9c2887e371e1485354a5f11363c8894dc40
MD5 8b3033e3669967be76a5ca7b97fe52cc
SHA1 45ed3d070ccb099f4425e1bafc0f9aee27e13433
SHA512 75ccbaefb8685da9c7280c339eb34562919a43fb18eebd29b7c9b9217f66f9666578f128eaca80c9bc5a9e1bc1f2d3754a1c78fde4ac2c47df43fb042e28db88
SSDEEP 384:2ZcIKJsNWZY0hE2zX5od+P8yQXLsFOObjI9G6w7z:k0XEqObIF29Mz
TLSH
T1AAC218F698EB5876C9AEA313B77E2D125EBCD027B6841A40B3E85B0CCC5957FC305816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c96b0e708df2a231c59492197b87caec5a62085bddd3fbe3ed2a60274f2708ea
MD5 3be2292e48434b96fbf93d26c857006b
SHA1 ceb1c1d09bfb24205bc8049d8ced15e7679ffafb
SHA512 4610a8d0af06252ed6f098e0afb5508713dc4630c495492527675f2102690bddc7754b5b9cbde474a60aac44f8c33eed5e8688e9d2e09471b7c8839339e6539f
SSDEEP 384:3ZcIhsN78YWcE2zX5od+P8yQXLtFOObjI9G6w7z:/hSEqObpF29Mz
TLSH
T17A928D32AC38AD7799E7F555F48B35135EF8907BE7881F84D1FCAB0C019A5AC030682A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 6cd6c0e664c756de66438cc2eaaf33cfd26f122bd047960c9c27e54a70ffdf8f
MD5 f1651bdc859907f46ff929b4a955864b
SHA1 bcc936d4d4ac5a7c0ba4994067bb9d5bb37444fc
SHA512 bd112e47f2469c11c1def74de57db03f3278466aec582ed93f9153551cb00cc29ff3db565ae5c5ce47d716710c28d0a38021bd962cf6b736b6ad48842d8f6903
SSDEEP 384:4ZcIhsN7ZYWcE2zX5od+P8yQXLtFOObjI9G6w7z:GhjEqObpF29Mz
TLSH
T1A3928D32AC28AD7799E7F555F48B35135EF8907BE7981F84D1FCAF0C019A5AC130682A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bb0f1edefb6a76168bc87db64e59e0871d5fff56a1944cd0210d4d4f0692a794
MD5 2178faceda51cbda8e43296165f9ed10
SHA1 45ee00d7e075301dd04edd41b547639cfd24ec8a
SHA512 43ebfba293e3367afb8bf55c84e3e591d565cce96437ca10eec13e9f4259c6cc7945b0b0111f01693d356f7de5cab9e03a0c43d11630e1615f6584040d33f824
SSDEEP 192:yONH61VWQmiUyXSgGX5Obd+jbjzoryyRAb/am32fU6:yONH6WzgGX5od+P8y6DfU6
TLSH
T18802C836A8686CAB8EE2BE49B44737135FD4206BEA556F84D6EC1F1C00D765C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 22784e5c14c4d7835953217cf918524b5850b72844546d93528ca2fc82a936ae
MD5 228d3a52e962afd6ef42ce44b4411eea
SHA1 22b339284a37bd20d04a8c0a70592941f14a50d7
SHA512 2a16b263386f128b61e5a3aa82083ba3f87ffbb0fcca7f1f0a2f1f27576d7e5768d6263b951a116f21f2ab963ec40138145b446e5641a255f8ca711d3f20918c
SSDEEP 192:XONW61uWQmiUy8SxGX5Obd+jbjzoryyRAMXLdjJ/q5cU6:XONW6H2xGX5od+P8yQXLPFU6
TLSH
T18B12E936A86CAC6B5DE2F585B48B31135EE55127EB856F80D6EC2F1C01DF66C230AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 44864a2729f02bfa40390ee6ff5c26d980975e3e4b8ee591d7561b80c13f8f38
MD5 07867b53652a1c9e78fcff29c3204ae7
SHA1 ec5de570402bb86c42738b68878820d1ec77f04c
SHA512 d05f96e0b3ee4dd617514f5c244499d47ca5d6ee91d7e917b7a72dd96f890446bc155294018bc1f746f4e637f4c7f4c95b17d0ec7d998ce9054f15ade2f27f91
SSDEEP 384:2ZcIKzsN7ZYWcE2zX5od+P8yQXLxFOObjI9G6w7z:kCjEqObFF29Mz
TLSH
T1F1928D32AC28AD7799E7F555B48B35135EF8903BD7C81F80D1FC9B0C059A5AC130682A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

909d3db8-4985-41b5-81dc-43edc656d245.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\909d3db8-4985-41b5-81dc-43edc656d245.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 09f1b0a24b5364e3b18460b452ea9139f92a33ab61fcc6d900c9379ee1a6dc8d
MD5 a9ef59af273e09e0abcf007d98b2d63a
SHA1 cd24a67c8dcacbd32d952ddb703d12b5286d1ba4
SHA512 8d69b613ada0c8c8b191420bd45e00bf98fd08ba3842578bcddd4a27fa40dcf528c88742ecc21510f67ce7f87572791c1c98d3ee92291a5eae181a44b06e2a38
TLSH
T17C41285CB6F91148B3B36E5A9BF6A8AE487ABC372E05C45E10110E4F4927B40CCA1B37
MD5 SHA1 SHA512 TLSH

Submit Download