hxxps://drive[.]google[.]com/file/d/1HLviieubo9PRL_SOjT3pZqbIouSGdVCt/view?usp=drivesdk

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/08/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://drive.google.com/file/d/1HLviieubo9PRL_SOjT3pZqbIouSGdVCt/view?usp=drivesdk
Sample260806-pespravvc1

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
11	drive.google.com
14	drive.google.com
51	drive.google.com
1	drive.google.com
2	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1808	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304921104621755"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{82B9E1D8-AF8A-4FB4-8A80-6C45DE99CB54}	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Full Release:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Full Release (1):Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Full Release (2):Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 2224	4368	msedge.exe	80
PID 4368 wrote to memory of 4772	4368	msedge.exe	82
PID 4368 wrote to memory of 1808	4368	msedge.exe	81
PID 4368 wrote to memory of 4772	4368	msedge.exe	82
PID 4368 wrote to memory of 4772	4368	msedge.exe	82
PID 4368 wrote to memory of 3240	4368	msedge.exe	83
PID 4368 wrote to memory of 3240	4368	msedge.exe	83
PID 4368 wrote to memory of 4036	4368	msedge.exe	85
PID 4368 wrote to memory of 4036	4368	msedge.exe	85
PID 4368 wrote to memory of 4036	4368	msedge.exe	85
PID 4368 wrote to memory of 4480	4368	msedge.exe	86
PID 4368 wrote to memory of 4480	4368	msedge.exe	86
PID 4368 wrote to memory of 4480	4368	msedge.exe	86
PID 4368 wrote to memory of 4768	4368	msedge.exe	88
PID 4368 wrote to memory of 2344	4368	msedge.exe	89
PID 4368 wrote to memory of 1892	4368	msedge.exe	90
PID 4368 wrote to memory of 4768	4368	msedge.exe	88
PID 4368 wrote to memory of 4768	4368	msedge.exe	88
PID 4368 wrote to memory of 3968	4368	msedge.exe	91
PID 4368 wrote to memory of 2344	4368	msedge.exe	89
PID 4368 wrote to memory of 2344	4368	msedge.exe	89
PID 4368 wrote to memory of 1892	4368	msedge.exe	90
PID 4368 wrote to memory of 1892	4368	msedge.exe	90
PID 4368 wrote to memory of 3968	4368	msedge.exe	91
PID 4368 wrote to memory of 3968	4368	msedge.exe	91
PID 4368 wrote to memory of 1740	4368	msedge.exe	93
PID 4368 wrote to memory of 1572	4368	msedge.exe	94
PID 4368 wrote to memory of 1740	4368	msedge.exe	93
PID 4368 wrote to memory of 1572	4368	msedge.exe	94
PID 4368 wrote to memory of 4196	4368	msedge.exe	95
PID 4196 wrote to memory of 1728	4196	msedge.exe	97
PID 4368 wrote to memory of 4580	4368	msedge.exe	98
PID 4368 wrote to memory of 2108	4368	msedge.exe	99
PID 4368 wrote to memory of 2108	4368	msedge.exe	99
PID 4368 wrote to memory of 2108	4368	msedge.exe	99
PID 4368 wrote to memory of 4140	4368	msedge.exe	100
PID 4368 wrote to memory of 4724	4368	msedge.exe	101
PID 4368 wrote to memory of 1488	4368	msedge.exe	102
PID 4368 wrote to memory of 2820	4368	msedge.exe	103
PID 4368 wrote to memory of 2856	4368	msedge.exe	104
PID 4368 wrote to memory of 2820	4368	msedge.exe	103
PID 4368 wrote to memory of 2856	4368	msedge.exe	104
PID 4368 wrote to memory of 2856	4368	msedge.exe	104
PID 4368 wrote to memory of 1428	4368	msedge.exe	105
PID 4368 wrote to memory of 1628	4368	msedge.exe	106
PID 4368 wrote to memory of 1628	4368	msedge.exe	106
PID 4368 wrote to memory of 220	4368	msedge.exe	108
PID 4368 wrote to memory of 1676	4368	msedge.exe	109
PID 4368 wrote to memory of 4668	4368	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1HLviieubo9PRL_SOjT3pZqbIouSGdVCt/view?usp=drivesdk
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffbef8cc188,0x7ffbef8cc194,0x7ffbef8cc1a0
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1640,i,5155460539499000806,13046449708317502303,524288 --field-trial-handle=1956,i,5809955544404169313,11008169831073748489,262144 --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,5666519723529998389,14782283405478406505,262144 --field-trial-handle=1956,i,5809955544404169313,11008169831073748489,262144 --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,13884550369419478397,16648926025319402944,524288 --field-trial-handle=1956,i,5809955544404169313,11008169831073748489,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:13
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,5625388732930721909,3715372909675559947,2097152 --field-trial-handle=1956,i,5809955544404169313,11008169831073748489,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,11733666040171494763,17868535112852433877,2097152 --field-trial-handle=1956,i,5809955544404169313,11008169831073748489,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4112,i,15926999725211853450,12744715895353596174,2097152 --field-trial-handle=1956,i,5809955544404169313,11008169831073748489,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4160,i,10491022450870678643,14848377420710564496,2097152 --field-trial-handle=1956,i,5809955544404169313,11008169831073748489,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:9
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4196,i,13376757480364754362,10673743370135187526,2097152 --field-trial-handle=1956,i,5809955544404169313,11008169831073748489,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4236,i,13619392104205322312,3973683058833384575,2097152 --field-trial-handle=1956,i,5809955544404169313,11008169831073748489,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:9
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,17466292977990949153,3720733616609667441,524288 --field-trial-handle=1956,i,5809955544404169313,11008169831073748489,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,7265361217191860308,10749994156840229083,524288 --field-trial-handle=1956,i,5809955544404169313,11008169831073748489,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:14
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,5995049723587215375,13859198368854904293,524288 --field-trial-handle=1956,i,5809955544404169313,11008169831073748489,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1096
    3⤵
    PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,10353281329818495014,13565644657847397584,524288 --field-trial-handle=1956,i,5809955544404169313,11008169831073748489,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,10353281329818495014,13565644657847397584,524288 --field-trial-handle=1956,i,5809955544404169313,11008169831073748489,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4208,i,9399701128112684723,6471159984654460751,2097152 --field-trial-handle=1956,i,5809955544404169313,11008169831073748489,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,2397988009650469599,15008403402634075384,524288 --field-trial-handle=1956,i,5809955544404169313,11008169831073748489,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,14133615157134844644,13322793276010505970,524288 --field-trial-handle=1956,i,5809955544404169313,11008169831073748489,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,11781336840590725481,13874529956368192867,524288 --field-trial-handle=1956,i,5809955544404169313,11008169831073748489,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:14
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,9787567675012348158,5278089820615686167,524288 --field-trial-handle=1956,i,5809955544404169313,11008169831073748489,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6900,i,1120184020110461216,8794376454651453697,2097152 --field-trial-handle=1956,i,5809955544404169313,11008169831073748489,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,7026685681500999001,11861485857282855687,524288 --field-trial-handle=1956,i,5809955544404169313,11008169831073748489,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:14
  2⤵
  - NTFS ADS
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,6709651026677993462,14276172517916819692,524288 --field-trial-handle=1956,i,5809955544404169313,11008169831073748489,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:14
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,14357235105348940648,9183902307200924071,524288 --field-trial-handle=1956,i,5809955544404169313,11008169831073748489,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
  2⤵
  - NTFS ADS
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6548,i,16620199856177122488,5169385529375752071,262144 --field-trial-handle=1956,i,5809955544404169313,11008169831073748489,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,5541971197046491876,12774177089729559413,524288 --field-trial-handle=1956,i,5809955544404169313,11008169831073748489,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4668

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 96356a1c0b2ee29ad881b49a1b821c86208118818f9f9f8a11e51bffcb2c70ae
MD5 32fd47dba5260d8b5bc72fefda67750d
SHA1 d56a3f7676f99497342f47dd6d1a4d23801da632
SHA512 b7a996f9c781113ae80e488cc2b89a328b52fb5d732c2c41e5d63687eaf4d74b0155211c7cb57278121b5a6ab39b5b0a974f5b8994a3279d8609a14cfaf1be44
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7g:fwUQC5VwBIiElEd2K57P7g
TLSH
T1F1B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
MD5 5de7bfd3f869f48e7255b6bdc532c4bc
SHA1 c26027eb70bc9887bf69c2b22be60226b685dbae
SHA512 0e6af8c455f57dc816a2c01366f46a0d069e8f41cccb1f7565e2afd873b71ffd5f135649fb4bf44d1a15a9efd68dc59696dc74a971b3483ec9d87a4323b2b4f2
TLSH
T112D08032FB5D6052E7455230D893DF10276644A12C974B41E325C84CD5B80D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
MD5 8c92d931ed33c3d779a020ae7e111fb4
SHA1 de123f6d92bf24747affe820aaa8be3785388fae
SHA512 5be895d6a61eacf4f3117293636fb4890abbe186ddcbfbb3c8d3aa0fd1aa59519bbdd86e552732d2ded27aae5be1ffb0d6d9f6ccaac824d1b13ed03a12a438dc
TLSH
T13BD08032BB9D6452E7455230D893DF10276644A12C978B42E325C84CD5B90D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a12112ebd805a06368f95cd33dc69d3e66eaf4d47547241b46cf9ef18681f477
MD5 25e2a9a3103d1be5a6bc9f718d34ae9a
SHA1 f7063d8f23268d23ecbf78681e8d29fc2cdad68a
SHA512 74d3edf0d942aabc523db23047f38208581c1bda56f7e2e5d9dc13f1c8e399aef7ac819911c029553e3b0d9edd3c78520a969b49fbf9d260b8ea337626325ea5
TLSH
T13E815D2A0A022103EF9235709EF11F15F67052DDDB5BCE9E4128EDFDE6353A8C9AE464
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f46d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f46d.TMP
Size 3KB
SHA256 1059d5b979be781dbdaecb537dd19ba9e024a5bbdc3c78bf89e56784108a6312
MD5 60cd8581a0db7c1c2d948adcb107b392
SHA1 232311ca7d9c69d2fa5c0493794a9828a1c4b00a
SHA512 23e1cb275dc665dd4731ce68a1dc8dcd4818aa680199d7f7f2617f9465667a2944d7ebbb5de9d495cf828a98ef71e6a6d6673500dfc0c0795b2485fec89d788c
TLSH
T17371386A06422613EFA130719DE21F42B6B182DDCBA3CEDE4148EDFDE6347A5C82E014
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 a10fa899040771996088eab4e4b129a6bea938f3a88830718f92103070bc7ea5
MD5 885e6374ca72aa9c29442c318ac81e8b
SHA1 09d9eb76366dc294e015ac1871ef4672c5891750
SHA512 af5bdbad0382c62d09f5a10241478af18689d5a5094c75cd686453ca0893ce3527e1491ec6bd2ca926131e90cdb9fbf7059920a2b9b4343c150a35ca0da5163e
SSDEEP 192:D+201GGcnBeaD8TFPvM2JpNueD8w80QcjEm8V9:DZ01GGcnBeaD8TFPvM2JpNueD8w80Qck
TLSH
T167E14AF7C3D9C12DC81556F89715AF1ECE290618431C3D26C8D8BE9BD3E2831E22665E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 46a0df471622c963fc7c97bb85652213f00aa3bdadc8e35e2599aa612b4ea4eb
MD5 bf4f4e0dc72e284d1856e6b9533c7bda
SHA1 9bda1cce98371c18ddde473b7e398a394a1a0265
SHA512 58d64d4de7a88d7716e1916cee501252694c6444db0662e6126ef802894d2a75cf31ceb8351015a2f9e4179d42d9db310351a14d2b0ac2d0dce2b74ece870156
SSDEEP 192:sxZ6RKyM/jK1Ml8Moq/fbXsqrcFIdplXPea/W6+WNy4xVyI/Y0oBqFMIg5jJ:sxZ60Qq/fjsqrc2z/bDn/5Mr
TLSH
T1BB52F952AA346A77CCDBD209FA55BF53D6F5056291900E54AAFCCA1C00F6BED321382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 df85a448422546cab05f851513ebb2065e009b4c3aeb308b41351681f262fe2e
MD5 5ddb0a5271ee83dc7dafce6bd799583f
SHA1 1e68b051a0dd03f3a342ca4d0410ca36818dfe17
SHA512 8ba609dc60c630ef89de0520a9083c7645c49ef6ebcf024308c058af4a90ca437f69c41bf240a2f0da7dc324781d860e5c921027e0421ea200d3bd7016756baf
SSDEEP 192:sxZ6RKyM/jK1Ml8MFq/fbXs9BcFIdpuY/W6+WNy4x/Y0o7bFMIgrJ:sxZ6Edq/fjs9Bc2r/bD/5R9
TLSH
T17052F902AA346977CCDBD209FA55BF53D6F9057292900E44A9FCDA1C00E6BED321782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b22f9e04c7e78bc317dfa9a98f525daa9552237786ba4a40402e70abfbcdc84c
MD5 ef228450e97d8b806330476a6ffa5186
SHA1 30738e22db18a1f2f56cbf1684d063680f8f8ac4
SHA512 856ad9bf99c98030d62c84c372fc0a0d90fd2b9d3d39940fc56ed6e7d6777dd58850eb0f1abd01e32d92f386e29b23b04546eda59f15e0c62a64ffedf99f67f8
SSDEEP 192:sxZ6RKyM/jK1Ml8MFq/fbXsqrcFIdpnpJ/W6+WNy4xVyI/Y0o8NFMIg5jJ:sxZ60dq/fjsqrc2v/bDn/5Or
TLSH
T18152FA52AA346977CCDBD209BA45BF53D6F9056391900E44AAFCCA1C00E6BED321382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 62eb7e68e5b763ba639fc699c97dcad6513f766963402578756fedc6e15710d7
MD5 22047b105120fbac2ce52a4ccece692b
SHA1 27342a7ed66647d7b881f4580f8b2b3fd51e2268
SHA512 f102c005d51b73afeed3774d7f0c99421c5f02b5b5a4b3d8f74340b2b3088a8d973ec638a82a0ad28a4d7c28aa9ba02fda9effb4a3e14a821c223a812d34ac01
SSDEEP 192:sxZ6RKyM/jK1Ml8UQGoq/fbXsqrcFIdplXTa/W6+WNy4xVyI/Y0oBqRMIg5jJ:sxZ60qNq/fjsqrc2c/bDn/5Ar
TLSH
T1CC62E952AA346A77CCDBD209FA55BF53D6F5056291900E54AAFCCA1C00F6BED321382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 651498a02af7e70bc7f457b156767c5b2c4b3caf36b74007774b90d2b19ccc8f
MD5 de699c5f545c1ec26b7d7499a578199d
SHA1 49af9d49065317da5ec7a4a7ffe7ff10fb5f80e9
SHA512 153be925d08796bed488918ce4bec05863fe99e54f49cc8d32dc9ab44a960f398e04030975c3c3459bf213f82485dbcb693fdaa8f1015d6f6559e1c67e9bc689
SSDEEP 768:O2c0s8Ww2YfWRm/JQg18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3BOLl/TB0OgFroCX:O2c0s8Ww2YfWRm/JQg1u1jaKBOLpTuO2
TLSH
T181E20A3B284CC77E4F840E9CEC26AF967ED802CBA6584D5447EE494C03C77EA521A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 aaa919d4db9aefd01fc13194161fd6ec2beee4c3c188650c3eda14fbcb7baca5
MD5 491a82bf2e3c4e6c9707e7eb89f73099
SHA1 617803cb78fbd91ca155c7d70df13fddd5b9e80e
SHA512 36cd024df3458ba0eb824f14778138174319094104173a41b45a51e4165ed25c68b4e0f955566245274dbdb5b9bd85c1281733604f98e689397d5b26e2e11461
SSDEEP 48:Kc0I7K1Ss3yF9IVKuIo+UIrKFicvy9zIVKY8Ay:Kc0AK1Seu9qKuIJUQKFi2ezGKY85
TLSH
T1F4B1408330B606063C7E3B4CA3958B1A494171637618B52B7BE906B65D3FE185DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e0e7b9b-4965-4739-9469-bdc921b07577.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6e0e7b9b-4965-4739-9469-bdc921b07577.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6f894cafca536a2993a4f077f4268c086f059dcb46fb9101b93c728da866b197
MD5 8316a6c7b86af692507873a8b07a2b56
SHA1 02586fbba05a4c904cea78964d56a855c557f6a4
SHA512 3b80b0e37f5770109e7d76216d71dfd150f97b6ba4428d49faf6b7ee8d0ffbd2148f3b049869357c42138dbf979071b00acd774d71743639cbfe12f23719e233
SSDEEP 384:LZcIh8N7zn8jEdF2Uu8YiusP+7uXMnTKwBODNZOCh5T:ThwvF/Ci1PkIMnewBKZOuT
TLSH
T14A926C715C6C6C37AEE6B544F94B36178EB85127EAD42F54C6FCBF1C00AA5982317C21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 baacb09cfe3fb49723427fc1f8bb9d73f6415aa51f0efc198b1c5fde472e4da2
MD5 c2bb49a349334eacd2bd4c3f6033d029
SHA1 26def5a9fd2c7a910627058047b955d05c37a3d7
SHA512 7d5310187c72b74d58b862ac0fdee0c3df39a0d1922abd0bdde24dcbab4361402ebaa14c90bc4a6e95c7bfaf84914c93ee5be79839848aa60c6d2c66ffb0eff7
SSDEEP 384:LiFiZcIT8NF8TUNTUlIldn8jEpF2Uu8YiusP+7uUhMnTKwBODNZOCh5T:mFQTAwg3jF/Ci1PkThMnewBKZOuT
TLSH
T11AD219F248DB9836D9AE5747A77E2D038EBCC163B5906A54B3D86A0CCC561BFD306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 bdae792d16669a8209d20fa5e820d0ece4a2582774dc8ffcae74192e880224b3
MD5 40e07576801662835d654180d4a30a8b
SHA1 22f9eefe396e4a98180eeec4f9834a2c851bf9aa
SHA512 625f6b67229634c64d590e37e86311cdc2f60e4a5f6afea63ed43b87b472028f91c5a5cf147366f909224f434ff35bde5fcd41da6368c8ac7a1db76e563fa68a
SSDEEP 384:aZcIh8N7dn8jEdF2Uu8YiusP+7uXMnTKwBODNZOCh5T:YhMvF/Ci1PkIMnewBKZOuT
TLSH
T16E927DB15C2C6C37AEE6B544FA4B36178EB85127EAD42F54C6FCBF1C009A5982317D21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 074735c107a1d08cd2dd6bf663ba9de3399134c10de22550feb179a8e6978049
MD5 823dd57e41af3a616aa972c249f4e768
SHA1 82fe7efd2143d734e84d7896f6617b9b28eb1ba9
SHA512 d87ab7e2669a34b43be531cd6cf009ebc23d41c941022b88559d5953cbef782d5f97ee816acde69c51bd078259f1d728b9c09c7166a3068a034b6780c4430869
SSDEEP 192:XGNv6jCQmiUyDI2f4SufoPxzY3Sus6+X+hNSnfKEOU6:XGNv6qkBfju8YiusP+AiEOU6
TLSH
T1C102D8356C687C6B9EB36E45FA8737139FA4212BA9812F44DAF81F1C00D765C2346832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cf3d30afb642651dae118ad4303b0fa8bc533d31f849abd64635b30a78277777
MD5 43de0c81e6646a0d9e5b68c72b2275cc
SHA1 32f5a2e4dd408d727cda623e43d80e8c8195e5e5
SHA512 0bc4a4525231932ec838055de4c96053e59d5b29c9805ef2d121777839bc62b82200a1fa2b1ff96c338bfa453c26ac95ed630c64fbe20bc7eb054d52aafc0b56
SSDEEP 192:cGNO6jpQmiUy+204SufoPxzY3Sus6+X+haSutMIOMAqyU6:cGNO6r60ju8YiusP+7udMU6
TLSH
T1A912F9716C68BC2B6EA36694F64736138FA51127EE857F44D6EC2E1C01EF69C7306C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Full Release (1).crdownload

Path C:\Users\Admin\Downloads\Full Release (1).crdownload
Size 4KB
SHA256 ed6fed418a79d3394548e6fa6cf6d90cb4f5e6432d9fc9a406880b974b06a942
MD5 cf4b865e3fe940c7fe3919dc08015059
SHA1 88512e3dac68d4e9cb2c675822780c3979d1ba4f
SHA512 78890cdf7d68434cc441dc9e352e71c3a6decfc7aedffffdc9cd0a6429593bda7cde2297cbf8aebad3c08c41d09a02ffa1ac339d5483a7b70b988eac8f934db2
SSDEEP 96:wEtTirryCC3xErMIZydHwHGQ0PPRkkh5CtLePSurmdlH1BHcaaHGr:wEtGr2CC3GZCQmpP5DmePSurmdlVB8aL
TLSH
T1C89199EA7E2490FD15C06F4FBC26BA38D455EDB04D5DDCA0C5AE8CCC8D169E74A8C145
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Full Release:Zone.Identifier

Path C:\Users\Admin\Downloads\Full Release:Zone.Identifier
Size 173B
SHA256 b56c2b54bb44412a40a67c13301741346a4158033e1c7123a4817f1e156676af
MD5 8bdb53a70c2d0ab62abd5bef15410ebd
SHA1 6d6947ffc930ab20d91c7f68bec4f58b283d6e11
SHA512 4e08e15ee7a1d403301ba7057669d12481a3a33303581fdf9fa34fea20b44834de6999a7123fd358ed35a032b70a11ee322edc73dfe5676b47ba9bc235f44367
TLSH
T14DC08CDBBD10DE118E6892A0065EB19C7C1FB25A489AC180CC2000BFA4C49A98DE20B3
MD5 SHA1 SHA512 TLSH

Submit Download