hxxps://gofile[.]io/d/6HAQxH

Analysis

user interaction
yes
max time kernel
208s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 23:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/6HAQxH
Sample260814-3ggbdsbl21

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
41	api.gofile.io
49	api.gofile.io
33	api.gofile.io
34	api.gofile.io
39	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4684	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312237516556032"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000020268dd3ae3dc014dd1574e46e3dc015edcdffa442cdd0114000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{1EC808CD-E945-4795-AA30-B3273E2457DF}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3432	msedge.exe
3432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
2972	OpenWith.exe
2972	OpenWith.exe
2972	OpenWith.exe
2972	OpenWith.exe
2972	OpenWith.exe
2972	OpenWith.exe
2972	OpenWith.exe
2972	OpenWith.exe
2972	OpenWith.exe
2972	OpenWith.exe
2972	OpenWith.exe
2972	OpenWith.exe
2972	OpenWith.exe
2972	OpenWith.exe
2972	OpenWith.exe
2972	OpenWith.exe
2972	OpenWith.exe
2972	OpenWith.exe
2972	OpenWith.exe
2972	OpenWith.exe
2972	OpenWith.exe
2972	OpenWith.exe
2972	OpenWith.exe
1868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 4308	1504	msedge.exe	85
PID 1504 wrote to memory of 4684	1504	msedge.exe	87
PID 1504 wrote to memory of 4652	1504	msedge.exe	88
PID 1504 wrote to memory of 1528	1504	msedge.exe	89
PID 1504 wrote to memory of 4652	1504	msedge.exe	88
PID 1504 wrote to memory of 4652	1504	msedge.exe	88
PID 1504 wrote to memory of 1528	1504	msedge.exe	89
PID 1504 wrote to memory of 3012	1504	msedge.exe	90
PID 1504 wrote to memory of 3012	1504	msedge.exe	90
PID 1504 wrote to memory of 3012	1504	msedge.exe	90
PID 1504 wrote to memory of 2056	1504	msedge.exe	91
PID 1504 wrote to memory of 2056	1504	msedge.exe	91
PID 1504 wrote to memory of 2056	1504	msedge.exe	91
PID 1504 wrote to memory of 2624	1504	msedge.exe	92
PID 1504 wrote to memory of 3688	1504	msedge.exe	93
PID 1504 wrote to memory of 2624	1504	msedge.exe	92
PID 1504 wrote to memory of 2624	1504	msedge.exe	92
PID 1504 wrote to memory of 3688	1504	msedge.exe	93
PID 1504 wrote to memory of 3688	1504	msedge.exe	93
PID 1504 wrote to memory of 3256	1504	msedge.exe	96
PID 1504 wrote to memory of 3256	1504	msedge.exe	96
PID 1504 wrote to memory of 4628	1504	msedge.exe	97
PID 1504 wrote to memory of 4628	1504	msedge.exe	97
PID 1504 wrote to memory of 4152	1504	msedge.exe	99
PID 1504 wrote to memory of 4452	1504	msedge.exe	100
PID 1504 wrote to memory of 4452	1504	msedge.exe	100
PID 1504 wrote to memory of 4452	1504	msedge.exe	100
PID 1504 wrote to memory of 4292	1504	msedge.exe	101
PID 1504 wrote to memory of 4292	1504	msedge.exe	101
PID 1504 wrote to memory of 1112	1504	msedge.exe	102
PID 1504 wrote to memory of 1112	1504	msedge.exe	102
PID 1504 wrote to memory of 1112	1504	msedge.exe	102
PID 1504 wrote to memory of 3788	1504	msedge.exe	103
PID 1504 wrote to memory of 4576	1504	msedge.exe	107
PID 1504 wrote to memory of 4576	1504	msedge.exe	107
PID 1504 wrote to memory of 4576	1504	msedge.exe	107
PID 1504 wrote to memory of 1940	1504	msedge.exe	109
PID 1504 wrote to memory of 4072	1504	msedge.exe	110
PID 1504 wrote to memory of 4828	1504	msedge.exe	111
PID 1504 wrote to memory of 2972	1504	msedge.exe	113
PID 1504 wrote to memory of 2972	1504	msedge.exe	113
PID 1504 wrote to memory of 1424	1504	msedge.exe	117
PID 1504 wrote to memory of 1424	1504	msedge.exe	117
PID 1504 wrote to memory of 1424	1504	msedge.exe	117
PID 1504 wrote to memory of 4504	1504	msedge.exe	119
PID 1504 wrote to memory of 4504	1504	msedge.exe	119
PID 1504 wrote to memory of 4504	1504	msedge.exe	119
PID 1504 wrote to memory of 1384	1504	msedge.exe	122
PID 1504 wrote to memory of 1384	1504	msedge.exe	122
PID 1504 wrote to memory of 2196	1504	msedge.exe	124
PID 1504 wrote to memory of 2196	1504	msedge.exe	124
PID 1504 wrote to memory of 2196	1504	msedge.exe	124
PID 1504 wrote to memory of 2424	1504	msedge.exe	125
PID 1504 wrote to memory of 2424	1504	msedge.exe	125
PID 1504 wrote to memory of 2424	1504	msedge.exe	125
PID 1504 wrote to memory of 2368	1504	msedge.exe	126
PID 1504 wrote to memory of 2368	1504	msedge.exe	126
PID 1504 wrote to memory of 2368	1504	msedge.exe	126
PID 1504 wrote to memory of 3492	1504	msedge.exe	127
PID 1504 wrote to memory of 3492	1504	msedge.exe	127
PID 1504 wrote to memory of 3492	1504	msedge.exe	127
PID 1504 wrote to memory of 3840	1504	msedge.exe	128
PID 1504 wrote to memory of 3840	1504	msedge.exe	128
PID 1504 wrote to memory of 3840	1504	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/6HAQxH
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffab253c188,0x7ffab253c194,0x7ffab253c1a0
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,14821397788828056614,17052858841020833136,524288 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,2822364921216250733,5520891233733189351,262144 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:2
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,11027345308732577414,2111481321025041953,524288 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,12790568895430308996,9301306438218649830,2097152 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,11585523179032468244,11479401940844268538,2097152 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,3206114515516413155,324516336944271129,2097152 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,8476399510394052890,8039704449630308469,2097152 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,9546223404897103175,1614553654027980554,524288 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,12708916509451577594,16669815494006693036,524288 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,286549504478730715,5577959399792693550,524288 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,286549504478730715,5577959399792693550,524288 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6204,i,4669520282373667024,10556911947866605215,2097152 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,7075034654120880910,6089884595552526582,524288 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6624,i,15150045509877181995,16052827143487203316,2097152 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,5816948898881097007,13330133545530838741,524288 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6328,i,16124092916635112375,17405974467515631851,2097152 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7100,i,3558267563751486589,17693118213611624304,524288 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:8
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7156,i,16762412649683737866,675073537277013434,524288 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3932,i,16082766889294210610,4229902726740141478,524288 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,5099769314719459478,5541009485996091300,524288 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6456,i,10883644187011474076,17416549012340339292,2097152 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7244,i,8757973858390665515,11847575426000374970,2097152 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,10554468682282602467,6351336854506478417,524288 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7428,i,16664240728718179792,9514756158435558034,2097152 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7556,i,4235727797404082090,7342104838671564650,2097152 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=7544 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7772,i,9323855118993934285,18091595545750313,2097152 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7524,i,1167364067654626496,8264059515210847970,2097152 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7636,i,17676073763629411840,5182967994865587508,2097152 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7564,i,108580950510851857,3818065649443634780,2097152 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8248,i,13373729055655981697,8934186504413391037,2097152 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=8296 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8404,i,755194162293620050,15305440852099590951,2097152 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=8384 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8900,i,10737855844813460278,7560722690715875133,524288 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=8880 /prefetch:8
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8900,i,10737855844813460278,7560722690715875133,524288 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=8880 /prefetch:8
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9164,i,12671756834644100607,17471661413134684377,2097152 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=9152 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8844,i,6800124936544531874,15016699003710377253,524288 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:8
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5200,i,18413638028908393771,8070812340377493257,262144 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,8989121165263549416,217504309726881978,524288 --field-trial-handle=2424,i,17474232591243305799,5270950270572271347,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1576

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2972

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 e0424f12e2966d4edd61d48eb03e7a78e7aa9d384165acd4a8973fc664dca54a
MD5 7acb47b9e36d0b80e2fc9707e9c8e89d
SHA1 551a4ce1b41fc63afca9012e67ab4229c732feb7
SHA512 9b137ab83de648a2382112e33229e3ec6225fb81e794374fa123d6e7e13e4de7bc9858a11d08d360a0f72c10415e71a0f49f1cffe9e27deeea1ca3cbacdcc9b3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7K:fwUQC5VwBIiElEd2K57P7K
TLSH
T16BB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5f21c2484e331c61ddff52b46cbf8498513b5234757c8746e10ae54e51e27f41
MD5 b0a46b7af0b38c25b50c8b3be8ddaba6
SHA1 116fda3e5dd4e6fbb38a6a806bd87ff4bae65ce9
SHA512 c5e35f661bd702679ca4d61b25d042ff3db55d8ecc7c6e4f7b71e1704afc680d61f84cf54b549c0d5de96ec173c72d7d2d837476990bf80dc57bc33a891f9f21
TLSH
T1EBD023707969F5D0C61C017451105E4037364571319B974BE1965C1D9DF00C0D3EFFD5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000d5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d5
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d6
Size 68KB
SHA256 fc70b88dddb2da85326b7ff7e1fa801f0099e5c0d3a85863afd2737af9b199a2
MD5 cb3d1e69fbf9c94b15e92f2fa26892f0
SHA1 b8e5aff1547d49a1285e2e0c4cb43dcd9993f468
SHA512 0f890af69b223aaec8bbc753bbc626f6cf0e0660182e38871a03337f1eec7be6b47cb9d5034a3cb8c226feb6cd964d396f56fecf07257f3cbc13de642c175ac2
SSDEEP 1536:1RrPSv8UR94fNhLVxko8PojNVcL7tk9/yGeJ3GI:PPZGefNhLVxko8MrcL7fJWI
TLSH
T16E63026A7FAAA437FB2C87016FF23034D1F8FD579034042826515BB5A4578E92326F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d7
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d8
Size 38KB
SHA256 3370f2e33b0f3a2dae282f78a6bda56adacc76aaf06c7b388db4fda41b90b92c
MD5 b06c7a8dd8ad214e1f952bfae09f9301
SHA1 a0ab87119773fcc0720f1732763c28db8200f802
SHA512 9755d8ce26ab5b0d2293f00285d2334dd48e4c1b6f78a452758821133bd3d7aa3c8134cb2fab12eebb7120e00feb0b719cacacea7c12eb977c937d5cc50c4c43
SSDEEP 768:MS2Glq2FZ5dIEmd9C/imy3NUm07IARvRqLI:dSYfydk7IARvRqLI
TLSH
T16003F12EB1C51EAC510CAB3D92B74368952353063E6952F08DC297CE8584BD06AEF3F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d9
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
TLSH
T1055302E4123CA75C49FC43EA5434D635BA4B31ADABD4102FB69BC4258F6EA824447CFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e5
Size 335KB
SHA256 510937c81cb1a502119ab143419709b78c971a487406b87287e5d0e818995e9a
MD5 9f9c9ac1a584487d0961c6af2cac057c
SHA1 dbe3f8ded8c2390dbf7263da9aae9c7dda1cd828
SHA512 5fd4adbc586cd8110325eac005eb71792205e8e0f0132971d0758747baa058290e23daa9d1fa4574982f227c4ef0f3eae2055873bdb293fd404cc753bec05421
SSDEEP 6144:1EYK/wn749QJWZHyBE3FQ8Buo3Faz9J0ze/79bZJQ6PXmMo9uLUz:1EYK/wn70h5sE3F4oVaRmzWJT3obz
TLSH
T1F6742325C2DDFB139B531A01147E5975C638E876E4C01FB28B3CE026AF26E2D1468DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 11KB
SHA256 6488efe089f616da38c970a375a0d6f377243d6dd40f1f8259853e3ae9d6436d
MD5 ce9f9c479c4763145796adf85537e862
SHA1 018f18d5a61396eb5eb43f633342f6bb5032a617
SHA512 3a1cce3898d4abdafe3e229bb4744fe6487e7947e7756bb9582c43a7217bd8508554fbc75992a34216cbdb542d6dfc6c5a0361882bd8e63c743ee94392e7bb6e
SSDEEP 192:NEOhG+sG0ZwFEwvc3hnJqmc9yZK0BU8IplT3a005a/rJNjGwgHoNA5nc0j4w:NjhAG0ZwFfvwcU0dHplLg5ernCHoNAeE
TLSH
T1D732FCB04592AC96DF484DB0F1D118B0B03931B2C9879FF607105E7FE8977B249DEA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 19eec57a873d5f295d1fe73476f52bb3b1b55de2ff5a09249a4bbb1228b1527a
MD5 0a7cd8e00bfa1ec3ffcd5e653dd6b3c4
SHA1 6c68c88a6b38004106f5c5e72f14ed449999db25
SHA512 b5502745350167c63fc2c20551e3fe36ba953753aaea0795e979e4d91371c09bca922db080c207bdebba295c6914770090b89453dfc200263afd44c9763c80d2
SSDEEP 96:fj8QP9ilE1ra7D2LVqaBunJH3WLblyBdN+la6/rD7HyWM6ybKMN:fhcE1ra7DEVqaBW3KoHg86/rD7HyN6y5
TLSH
T1FE9152B445826C93EB1C8DB0D0E56121B471B6F2CAC79ED902440EBFE58A7764AAF748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58bd50.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bd50.TMP
Size 3KB
SHA256 0a7176005eb253b139ceb8eb73fb12131fc2e49d470cff75c69f5e898997c19e
MD5 4ba130c8b7e9606d995b5c5b8fa5c9c5
SHA1 dd228ad33728d448ad8255f671150da39eb9c089
SHA512 eeda5cf4a3d397a695fae7ad874574a90dbead2aeedc097f0c3882ffa58c10a426784c5726b7b77ae62243ac0734de7048bbed8f8ea2f03ffe37e7aafe7f8834
TLSH
T10C613BE405028993EF2D8DB0D0B11272B4B0B7B38AC70FCD01501BBFE69A7264D57718
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b79a54002b8fcf092e6b9991f9f0cd9323241c9fc1292ce601e8e525da94760d
MD5 cee8280a5b10e487f19b03258d564182
SHA1 43c73c4b1054cb1fc1c8e6c0fdc3480045035ae2
SHA512 b05fbcce4d251e4aeade89b70ee2c749289f73b8dfb7930d6acbe41b88480bcb5e54d8847ee8e13701c4db69c59c79f33bc79bbe1bec108801c928657bc6f13a
SSDEEP 3:MsEllllkEthXllkl2zExll5xKlX:/M/xT02z6K1
TLSH
T1E94404FDFFD00405C51153304117C3540370D450551157D374D10C137CC5D500C44000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 20KB
SHA256 899a41c9b5a1de67f31421c5e9ad01579bea02ad652d4ea528c50700608e2d31
MD5 117b12df38b283c7d22748cec784bd6a
SHA1 675abcfd7e553d007783ccc84ca435ce03c79735
SHA512 94b999334f067f09d302836e0db94a1f68464d19192b8ac94a75fd91af1000a536dcb810eddc1cf7119e0e3d17674054024ab7863aebdfafcb9123d4d8c3ea6f
SSDEEP 384:DCEZLgPZsHjOyEd799aYoe6yIa26BefhQJOXJhJBy1SPhM82QyHclFGCttjDnOb+:aryfBJQtn0CtB4
TLSH
T1009290F6C3E8C6BD9A5156F2AA287F2FDD1E0518831C3C1A8DE59F4793E2432D14198E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 eaca70caa300e57e2b2d310cb36214e40306fb2dc9f8ceca919982ace553ada0
MD5 7aebed70b4c9e555c286bb6caf31a73c
SHA1 f38285b3799cefaca86109d6e8ee8bbb5c42ee22
SHA512 35f4a454933fb4ab573a25769ae76d4badc75b6da690ddd8cf98435090640dfd0f27862d996e33ae40e961e314a4a41397a0b3b942ba08b96c0a40787104da9a
SSDEEP 96:DbOEZLgPZs/zBSP+yM82QyHclFGwBHittjESnOJx:DCEZLgPZs/1SPhM82QyHclFGkCttjDn0
TLSH
T17BC1ABF3C3E9826DD91162F19E186F1BCE1D0556836C3D5AC9D4AE0BA3F2471E142B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 8af9065a620facc67aa9901dd48df7752147f3eff47c227adb9a939ef546ab0d
MD5 10b19be364a13bbe838c9db9820f4af1
SHA1 74bae08e2cbcf387ba21ac6813e2ea57c1e36aa7
SHA512 4ec4ec66d7dc72499cfe4fa76c88e9b70f7c70c58d17e93a36c3b95b1e0d09ed30f64a268f8499ca4cc4e912cbafcc171e429ea929ab88cf212e8cf49b622ca3
TLSH
T140D022B3520130F4E55E3EE3926EECCFC33680600C829DDE12D05CAD0A3246C4907283
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe593389.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe593389.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 20fd9c6889c055dee4450aaadd098bfab511a7c0b27c6bbbdbe5db3b1eba880c
MD5 e6f35b8b5c50afde61d394adebebde47
SHA1 570bccf096604283e093a3d6b7003653e2b86b44
SHA512 6edb237453f5b33bbf07ff43c8c5586cc9b080db0554ed0304719eeb34689ed3a6109a4a55b6dae431e79d532c9ab7bbb1f9936dccede6b2ec8a12142e1ac1c0
SSDEEP 192:sxZhR1yM/jK1Ml8M90/fOsY0EIdpjlCHW6+WNeB9Z/YLmdynTIgrJ:sxZhn10/fOsY0dwHbKb/V69
TLSH
T1E452EA116A34A977CCDBD209FA55BF53D7F51472A2900D44ADFC8A1C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 1cad14a75c2796119ab82c32f495218cd4ebecdad377e96a5efb5d1f1d3ab3b7
MD5 46be4b49aef2d1d8b084b3b57f1cc2f3
SHA1 ce6bd184aaa404d1f3317897e61de2ebb373471e
SHA512 0104082ee043a727328dbadf8bf1817897dc99cfcbc8f3ed3691fbcec4817d5eb30006d8f79eaca7a5eebd6037b67992b2f33194e6ca7ffb79cff104733c4f77
SSDEEP 384:sxZqnqgm40/fOsjAZR9Hb2EMAw/dC0eW0n:sSqgm40/fNANHbFOU0eW0n
TLSH
T1D592D752652089B7CCDAD508BD35BF52E7F514639D910E8CAEFCCA0C04EA6FD261782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 cc22e71722574434e59725d9fda0d0ad9a6b163b60df05e0cd5f5fe257a5a43c
MD5 374d33685b54e16fd9dff90fd0e0969d
SHA1 cd460b4381ab6513eb0552f07954a6aa207a77ed
SHA512 b82cc0632170ae051a73312a53c09721fa92ef784d9384adf8c45928c31f9ad9ac0e7045ca0f855b83fc2cb1cef3c15bc1fc7fddb0ffe2bff456e51284caf930
SSDEEP 384:sxZqnqmm40/fOsYWv5AQR9HbnEMAw/nQ0eW0n:sSqmm40/fuY5AmHbkOQ0eW0n
TLSH
T188A2E752652089B7CCDAD508BD35BF52D7F814639D911E8CAEFCCA0C00EA6FD261786B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 51c1272e2d0d2c08f808303f1008b8b16b0cf80802e218976f2e927238b8a29f
MD5 ad7e47d2ba44a7dcdc1854164a93e73e
SHA1 18db7ffe1aabe9809b89a57e272f0abf6b019954
SHA512 b0a3e688ff66795f44d2668ce8d4e85142751cf3a414b279a7d45898a65646ba4357ad6af3ba924f8de7de672f3f2f2234d930094c26d54566c503f38be27556
SSDEEP 192:sxZqR1yM/jK1Ml8MWP0/fOsjA9bb8NdpmjlCHW6+WNe/s4xF/YL+ynTIg51mn0B8:sxZqnuP0/fOsjAqhDHbRU/gC0+
TLSH
T11272EA52662499778CCBD508BD25BF53E7F90463DE550E4CAAFCCA0C04E66ED221782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 97f3714cc18ae1254481bc52bf0f65232ce975e153d6476aaafd734b68d25d1f
MD5 7b2f553e68e01faa9287ce91daae95f6
SHA1 0fa51a131cd3a0e4de0208ff38d41dcf87160fb1
SHA512 67b880d07f5e5bea78ba5614bd38f06d1e12d92284c417866d24413b31b70a9e9ff69e14412714f371bd86bc72196a97b3c56528b52fb54d989d668433cbc616
SSDEEP 192:sxZqR1yM/jK1Ml8M0cB40/fOsjAsbb8nddpm/wslCHW6+WNFF/s4xFHFD/YLuynC:sxZqnsm40/fOsjA5RfHboUF/MC0eg/0n
TLSH
T12A92D952652089B7CCDBD508BD35BF52EBF904639D550E8CAEFCC90C04AA6FD261782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ffec8bd828ac1492dec12147431f970f832364a07adbffca8eb4e1145c5caed5
MD5 56acad53e242b4991c9549f163c671bd
SHA1 073db35427c7d3dea92fab56f58a8a454d618e00
SHA512 ef365a0e3c885508baea8f3406f8fa178d3f57ca100adabb1458fb48c252362f91d3f120bc365c6f8daf5807041785fa98d005a70b675a43a8bb0849fa2134e2
SSDEEP 768:kms6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNUroIb:kms6pD1WvxzWju1jahILIsN/Ib
TLSH
T1FED2FB3B680CC77E4F841E5CEC2AAF967DD801CBAB98899447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
Size 1KB
SHA256 99154327e4c50e1d6b36b6c1cd35a7fe549a5c6792f378553f23c31748b08337
MD5 534ae418b71fc7cebd345293d7bd4029
SHA1 097bd006ab63cb8d9a65743785ae18c209c0514c
SHA512 f5fcbcb674f622e3fc0bd66c356afa3f7576cce0f8faf36c25922f4b4d3b61baffdc4d388353e43c9444d95734fe4eae18a7d0ed52897b127cc89df5a8259f45
TLSH
T10031308D9EA1D99FE4A480B21176E5A8B370D8CD8B36B7138C2C31317E27319294B5DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
Size 3KB
SHA256 41d73aa09ed2d597f7b77910fa26bd887af077fa25e86002519da0506b71f4e7
MD5 790c6e00fa1e4a8fb5759114d9104465
SHA1 139208a952ae4866ca54cc7c41fedbab471fadaa
SHA512 513f2bbd8219316598b8f2f8c4e402919605d7032c901d56af7559fbc4500cce0e1a545755a5b364b88a8ec9cc7d44fbe80bf0c0fad08a19c5daf7929fee4674
TLSH
T1F551D88F0C891DADC96D50B22CFE1981377A6CDEA7599E176ADD9130B8C333B1D05219
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c678.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index~RFe58c678.TMP
Size 1KB
SHA256 ca47a6f600425ba1f24f358376250999cf6e077e8fa28a654f8ed776749a6402
MD5 2aeb8c1f9d3f516488ef69702c591535
SHA1 3dfdaa02c02821a69e012e178c17125d44ef2127
SHA512 dfbb384239381234cbdab4c56e0bd65707b7b3e6056b41d98d50f3a3428de277f1ef1543c1b46214b95cf679a0fa49703104c89826f35b1acd6d726b4371d74f
TLSH
T1BC31424A4AD18D1BF4C8507B0A67A4B8B33589408321B793987C62399D35B8E1E5F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c575eb0c-4021-4370-8d95-03811b891285\index-dir\the-real-index
Size 72B
SHA256 beaf593a60c1a9beb355eeebe3f6504f4306bebe49d60ac0eb2d3b528eb8f40f
MD5 1927cedbf2590bb11fe009386baf369f
SHA1 016e524482d097a85e70ad349f444087cfe7ff0b
SHA512 0526d5e8d256f5ad89a39bea6809bc1324d5cc1bad0d2cbd8e4f149e461334724f6472be97ce1c2e4e61fa67d11891e6f74fbcde0561d61b8db6c4b81c449165
TLSH
T170A0021456D02027C80717F025E60176321D8A64A301671942918359E850979A54744C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c575eb0c-4021-4370-8d95-03811b891285\index-dir\the-real-index
Size 72B
SHA256 1939415641a4362b3adf7619f8fcc7f30120dee51eb9f77db0a2a018959b7cd6
MD5 c3029ef73f5cc291280dc09b979323cb
SHA1 f21c2aa0a75313dc376e6ee571e9f3eb781ea8f5
SHA512 c2a14fc086b5a1df58d4039d33aa2740f669fd2829e744b0f6bfa6ca1031c000d28da68dc9c566f61afa6f13f1ad46af89c3de0354eccb9c1d9fc0945803fc03
TLSH
T1D3A0045017C30C55C15311F5555307417304CC301100D30FC0D103CCDC715734DC114C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 c8020004fd0b0f42f6e888b5b13ae325c1b964658627c2606aa46e2e3835f522
MD5 804518f65155d597a08080f849eb0405
SHA1 fb8e6a8d627b4805f5cfb501d1213d553ca09958
SHA512 11fb88d4799ea2e09ac8a1e8c8b2d8898c28dfb2d68e9c9fd5e3fe71289d76ecd9375f5fd993f0d2b2f1cccf442e0548ff059ddfb9fa42b0adfb754244610642
TLSH
T1F5E06FBB2EA32820EDABE3E32830A4B10241382C8800BC0F686A96C350B03213856C21
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 46b93c48a5c1ca7a343d6fc1fb006e6fcb561e85c19eeed430d963a7cb05efe4
MD5 56ba11536199cf56df72ca1033034f4c
SHA1 524a53f151081462a02ff65364cdd3588edaed81
SHA512 d244b5245dca91f59c7edad81166d937527556787679670794f7ca8bdeb5c06ae595bcb18a1c3c82f1f4c8478f48429b4b4e1989149b3171b9bc5333c5678e6e
TLSH
T109A00269C9B4C051E0092671D26601CC7260DCDAA645233150AD04F48DB8250C5A6504
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591da0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591da0.TMP
Size 48B
SHA256 111ed14618ebea91e67219f9c6e405d620013bbdac7d1b79cff39607062a9831
MD5 db3da9462002ffc7fa2d243877317d8d
SHA1 82046380645f41e06cf478eec784cfe55a518ec7
SHA512 61c38722ce8ee0ca54ead3482633fbc41621adbc2f70563c4915fbaa8854270af6286ce32216c47b9c779e61b6fa4ffb8100c25c274e5ca98f4ffcd0f9f6c728
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 f292020b96eea457bb8cdd02bfb4a4df33c7bb96e249fc484a8dc8a951eee47c
MD5 f2feac7ed8ac0aaebbb6a70e865b2395
SHA1 cd0b24a717efec7122563890c96e4f10897893ab
SHA512 76150c1127379faa227fdae2236209ec3de9118413fdf5021da8a49653835b31a577a861538ed34ec7ab1e10c0b009aa8a788b3807e8c829ff5660b79175df16
SSDEEP 96:KUAAKtePW7iKEM+qCZ67g86wQx5cpszExKL4zaxviqREQSKkwKZiSQ:iihRJ67g86wQvcpgE24zaBiqREQSni
TLSH
T1DDD1E21672BA12023D7F294893D497678EC272537014A42B3BAC04B6CDA7E21DEFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593e67.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593e67.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 a019e27627ff4a24a07615bf20fb5486be157c286f05398191ec6db89d9fd31f
MD5 c728e7588be16a4794078098a701df91
SHA1 2c8c0744fe1ec001ac4c9f3a2ea90e9f8312264e
SHA512 29ea7db2e401cc84bf7120b57dcd56e9db2567236c74bde6d288760b84f7dadcdacc1d5f75797fd8f501edd87d8c9d103fea5b997f0ec27be04a0f15055bb81b
SSDEEP 384:4tiFLZcITsNC8TUNTUlIllTvFSMa9xO7glzJrsTOOPrXLpe8C/87:jFTT5wgYVDO7g9hsTOi9PF
TLSH
T160D209F258D79876E9AE9747E77E2D038EBCC067B5815984B398990CCC961BFC306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 411ac90ba463e4151737d53253d969ba3e521732b88d7929eabc85caa4f72063
MD5 0757f633ee0c4db2b66ad7726eb92040
SHA1 f6a5c841abf71681b2503051342f438977caec04
SHA512 d56df72d3608e3aa0aef5bd5c50d893c0bf1fae3a9fb3e883d579a7ab488b034eee078a7e679037f1847b3823b8a5fd481ebf0dd59679660cc3d2e1c66aa6e97
SSDEEP 384:9CZcI/sNvL5Kjga9xO7glzJrRTOOPrXLpe8C/87:u/nJDO7g9hRTOi9PF
TLSH
T105927C31A8786C676CF6A585F94732178FF880B7E6C52A84D5ECDF0D01DB6A8131AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ffe34af32043bc4af375088c3ebacc12aaea7bbc3ac3b3648e00968e7cf0fb5f
MD5 cd84077de51e33abeef5f4e313f1eb7c
SHA1 a1d79dcdbacacd65f9dd059d4de1716937ff94a1
SHA512 4a456b297be7f3d6916bfce63f929a9e2bb9697aa93611744ed8ea431b1d11a1faa5f8d715492aa03d854b64eef4b86cb55978f74471366f7f3bf6f85c820811
SSDEEP 768:jFGWdQwgyVDO7g9hcHh4Dr0KBb437ZOi9PF:8WdzwKBMrZOg
TLSH
T1A8F25AE184D75CB6D4AD97C7A77DAD0259BCC073B4884908B3E4A92CEC8B5BFD316811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6986a86d51adb76b0eda0b4c3fa1aa8149678fb08634b12ef1db657d607b8fc7
MD5 0eb7030cb3c7264ed700fc9b74c61b9a
SHA1 af10aa5589ddf0dce3abd748ce5aa83b9679630d
SHA512 b2cfb2aaaedb5f878aaf6dfd001b1d3c8f95ce220f1a2e6889fb8c78c4f4f9523dbf16536250e20144c4b852b2871316bec4b2db53899740127b305c58bf8103
SSDEEP 192:qONx6O7+3hQmiUyfBGttb0gO2VoIgGKmU6:qONx61mGt9xO7+9U6
TLSH
T1F402E8356D686CB75EF2AE45F98737239FA8103BE9962F40D6E85E0C00D765C2347827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 918ec87e3b969bca37536af2e132aeca4434cebb8aec78f8a72bfaa03bc41243
MD5 dfca4b35ae8060009a2f6f7322de2257
SHA1 b0d8b7338d6617b9235db70e111339e389192630
SHA512 3efb404e9f9f8fc9b01d5e3548af75f77255537e298abfc557109497f72dd9c98dbeced495ed2478e981c4a45ae34cc29389302d2f36915e60266a3cdd20951a
SSDEEP 384:9pZcIhsNvf5Ajga9xO7glzJrRTOOPrXLpe8C/87:3hBJDO7g9hRTOi9PF
TLSH
T107928C31A8786C626DF6B585F98736178FF88077E6C52A84D5ECDF0D01EB6A8031AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 fb9595fe939ad5f2302c5a6964ee51fd93448657bc00c12603b7488660ee73dd
MD5 d1c880bf2968be0f9cac08cc9aec6bf1
SHA1 b6ad5394df7488ae984b91f4341eb12d6e199bc5
SHA512 89deca944bd5ec0c9f729e46108649d2f425926c39a0537c113b9cdc7633eaed8ffc15afe32a08e5b560c460e83c56af5c057fe2158035ee435a150995971f2a
SSDEEP 384:w4ZcIQsNvlTvcER2a9xO7glzJrQTOOPrXLpe8C/87:jQOR3DO7g9hQTOi9PF
TLSH
T19F927C31A8786C666CF6B585F98736138FF88077E6C52E8495ECDF0D01DB6A8131AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5f1f9d81ccc29f1100738705abaed4c7f9fbf9790b393cb0188de9241db57f3c
MD5 8ae7415029700c8aed940dbe070db6c6
SHA1 3018e002fbc642080466882a8df408c5d8638301
SHA512 14cccbb70ef7df580071d8baa10a35df30609e02be8092c671480f5806a5e73fc8a221d188c823d189e0251988f818987b13b9085f9a5b9ad308a581b2c0805d
SSDEEP 192:fONK6O7+30QmiUyHBAttb0gO2VogHF0SJrNWcN2qNpU6:fONK6uEAt9xO7glzJrNTU6
TLSH
T184121935B868AC775DE2A045F98731579FA9417BEA862F80D5EC1E0C01EF6AC234AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 770281052060faee0c1680cb6d892332fe021280e23dcf81dcfa599c1dfb35da
MD5 4b56b70264dd6811c5ed3061f9dabe6e
SHA1 f1fdc58279dd6707a8f9f8c64232c7ecd0dee743
SHA512 3f4914fbb169b0abd14f5a8ed5f7a017b19e59b5806e7480092f400f71f9ee1583be738fa7719f399a44e61b723ee9ff82da53769f4850827893b8f260ff79b7
SSDEEP 384:4tiFPZcI9sNR8TUNTUlIllTvcNMa9xO7glzJrvTOOPrXLpe8C/87:jFH9cwgyVDO7g9hvTOi9PF
TLSH
T128D219F258D79876E9AE5747E77E2D038EBCC067B5815984B3989A0CCC961BFC306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a8b7b2455baa826d73ffa8744c3d0e2e580d2ba3a6824d2def062d0f0df03997
MD5 e26446755b0953ea0b5d744d547bf56f
SHA1 b59cc32771534aca1a6a38c35d10ccd7f7817db6
SHA512 6967ba31ef55950126c29d6f0b7fdc6feed755b115d48ad0417e19c1bac858544582f45e13aa5e01388349c6577a0f587f678add218f57cbaee52c31d4994dd0
TLSH
T137E00103574040EDE038033001831B301ED3C03405B246465F2045691C637052F21FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 42de5eff370ba3fada7f445ee3377da491941d98cd07e89e5b8ec119b73ea40d
MD5 aa1a8b754167c2eb6ffc51dca695c59e
SHA1 e06c94f4e8906cced04f72bb043529ebdc029723
SHA512 bf7abcf0ea2e32a73fd17a75764ee33c546dd93ce5d4e465adbf181253f82b0547db887a0f9471eb626a4d73f6070bb328a8a1351180c7d22dbc0094c7b89ce8
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2f079ae723c8c3aac0b0324a85b881ee48591cc2284621af3dacf690d9652870
MD5 f23d714c6026f601cb0325ced4f29e34
SHA1 5ab4474b61024645ef2911bc20f1c8b721442f6a
SHA512 b59064e13886b458a8e220f81416d9a39914178f9e39401d3cb3d83605aa66cdd768680ea92b14e0eaf3d0ed6e035d99d8463693bf0d3316267d6af3028f95ad
TLSH
T14CE00943974040EEE038433101831B302EA2807406B246865F2045691C737053F21FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 543cf38e827e46af44c886b1f03a8beed40e9ec7e4595ec6ce2970065f3737b6
MD5 1d13e93291a2d5d1f86bd3e6135ffc0b
SHA1 8e0214b5a4aa6b4506502f14980f7e354d7bf575
SHA512 41e3dd103943138d0afd6333dca4f2227374c04677b508426dfcb1f1f695fb721cbbb19e3f7555de4c3664240d56e20baf8daa6169e27d19710e755595e8077c
TLSH
T1F5E00203174040ECE0380330014317300AC3C03404F046455E10455508536041F31FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe590035.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe590035.TMP
Size 392B
SHA256 6f663d689db170bf1a62d40c44b458deaadc12786988b997db0475a5d5339ec5
MD5 d3f9772cd527e578ef4ea593f3b72e61
SHA1 a30ec67a3fca0b81442c6e33763e666d578ddaf3
SHA512 b7e0f254f02d4b5eaae4c5f73fcb734b9f1a46cd4fec448773c5de8bf3b699097cf048d13a54c3fe2ea06866af95db958d90faefe1c6b063d502a4331f8b20f1
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b59b380ebb41b628f58397457f3b8c7d59deee23cf3bb2bb2b5f43496e0bc934
MD5 76dcfff503f82755b2d81126992f92f0
SHA1 e0d7c2926beb7aed0609607858fd4d434fe3058a
SHA512 ce5a4449759c120ff9de254c586d11162e6e4f73a616e49edabebd8db074ac8b69e4489841730ccede692c49e628d57b9e5f3494e49d3bca7b3983db85be08a5
TLSH
T1034116A8B6E91108B3776F56ABF6A46E447BB9773E06D05D10010E4E0A63B40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 8KB
SHA256 ab65201f42d623c2ed998c2ac331863fc674eca0accf1653ce243c5905245939
MD5 34c22f9474b9e338276a4f8b4394cfbf
SHA1 3b23cf96bb2843824fdf60bca47b650df0c30a92
SHA512 888062fb9396bb0e807f2cd302f35a62f2a6b31e4ab549631885eb3bca920b88aa1b958880de3f5b2d59bb546748eb66040f4f55527968bdfe105994035407f4
SSDEEP 96:mzMrOJkewB4SzMOJYkbFw0XqVzuOJru9IxzJOJnIu9P:mYOfSYOZqVSO5wINOBIwP
TLSH
T1EB02F240ABFA2A11F2F7ED71E9B26711EF36B90559189E0D008482091C32F05D9BAFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Velocity.7z

Path C:\Users\Admin\Downloads\Velocity.7z
Size 19.7MB
SHA256 f27865ff8f60776ebd4febc0d8528aa3530396d4e4534ebe2b4f765e047b05aa
MD5 34be7067f85591003987566f89d44875
SHA1 7f748c3bda15f3d0e4fde3328256dba7362cec91
SHA512 4b3e5ad786992074a46467e85cb9eaec2de7d729d804ec358ab4c0e239a4a5d463464ba8d203cd8057eb45d2dd9f1ccda5db6784b4180a3fa4ff52a5066f7213
SSDEEP 393216:xR3TMYTPpaIJz3HJedxrwR8+6k2MTYIh8ogjpH/yo+5JUYvaQTzVmeOj12BT:LoYjJz3HJePkR8XvIYIh8ogh/4vaqzHT
TLSH
T1EA2733F8AB8CF8ECB7C73B687D857AC900D446E34249CB30A967A724F2715A651F9530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download