hxxps://drive[.]google[.]com/file/d/1MKM1RVkw3XTD-spIAPCs4iInjBj_IuCI/view?usp=sharing

Analysis

max time kernel
898s
max time network
886s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 08:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://drive.google.com/file/d/1MKM1RVkw3XTD-spIAPCs4iInjBj_IuCI/view?usp=sharing
Sample260910-j6n8razgqa

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
45	drive.google.com
9	drive.google.com
10	drive.google.com
24	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1456	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335025297189848"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{C7C2DCF6-CB5E-4BED-9D41-73ED0A7162C0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 4380	4192	msedge.exe	86
PID 4192 wrote to memory of 1456	4192	msedge.exe	87
PID 4192 wrote to memory of 4732	4192	msedge.exe	89
PID 4192 wrote to memory of 4732	4192	msedge.exe	89
PID 4192 wrote to memory of 2100	4192	msedge.exe	88
PID 4192 wrote to memory of 2100	4192	msedge.exe	88
PID 4192 wrote to memory of 2100	4192	msedge.exe	88
PID 4192 wrote to memory of 1380	4192	msedge.exe	90
PID 4192 wrote to memory of 1380	4192	msedge.exe	90
PID 4192 wrote to memory of 1380	4192	msedge.exe	90
PID 4192 wrote to memory of 1848	4192	msedge.exe	91
PID 4192 wrote to memory of 1848	4192	msedge.exe	91
PID 4192 wrote to memory of 1848	4192	msedge.exe	91
PID 4192 wrote to memory of 3748	4192	msedge.exe	93
PID 4192 wrote to memory of 2768	4192	msedge.exe	94
PID 4192 wrote to memory of 3748	4192	msedge.exe	93
PID 4192 wrote to memory of 3748	4192	msedge.exe	93
PID 4192 wrote to memory of 2768	4192	msedge.exe	94
PID 4192 wrote to memory of 2768	4192	msedge.exe	94
PID 4192 wrote to memory of 2400	4192	msedge.exe	98
PID 4192 wrote to memory of 2400	4192	msedge.exe	98
PID 4192 wrote to memory of 1216	4192	msedge.exe	99
PID 4192 wrote to memory of 1216	4192	msedge.exe	99
PID 4192 wrote to memory of 4316	4192	msedge.exe	101
PID 4192 wrote to memory of 3124	4192	msedge.exe	111
PID 4192 wrote to memory of 4196	4192	msedge.exe	112
PID 4192 wrote to memory of 2304	4192	msedge.exe	113
PID 4192 wrote to memory of 620	4192	msedge.exe	115
PID 4192 wrote to memory of 620	4192	msedge.exe	115
PID 4192 wrote to memory of 4748	4192	msedge.exe	116
PID 4192 wrote to memory of 1012	4192	msedge.exe	118
PID 4192 wrote to memory of 1112	4192	msedge.exe	117
PID 4192 wrote to memory of 1012	4192	msedge.exe	118
PID 4192 wrote to memory of 1112	4192	msedge.exe	117
PID 4192 wrote to memory of 1924	4192	msedge.exe	119
PID 4192 wrote to memory of 1924	4192	msedge.exe	119
PID 4192 wrote to memory of 556	4192	msedge.exe	120
PID 4192 wrote to memory of 556	4192	msedge.exe	120
PID 4192 wrote to memory of 2776	4192	msedge.exe	121
PID 4192 wrote to memory of 2776	4192	msedge.exe	121
PID 4192 wrote to memory of 3368	4192	msedge.exe	122
PID 4192 wrote to memory of 3368	4192	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1MKM1RVkw3XTD-spIAPCs4iInjBj_IuCI/view?usp=sharing
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffa062ac188,0x7ffa062ac194,0x7ffa062ac1a0
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,17266942649499613378,15295378601202164841,524288 --field-trial-handle=2404,i,14618740337879516734,18325570450432065286,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,7773205193250271890,4995818544501741778,262144 --field-trial-handle=2404,i,14618740337879516734,18325570450432065286,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:2
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,3791178265860653479,4337763004558702905,524288 --field-trial-handle=2404,i,14618740337879516734,18325570450432065286,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,18152348768408132684,9917745546594460335,2097152 --field-trial-handle=2404,i,14618740337879516734,18325570450432065286,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,2219827169951414469,5928981647632451203,2097152 --field-trial-handle=2404,i,14618740337879516734,18325570450432065286,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,12540136474550203606,13632521323556593589,2097152 --field-trial-handle=2404,i,14618740337879516734,18325570450432065286,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,1187647353848077539,14256666252417048065,2097152 --field-trial-handle=2404,i,14618740337879516734,18325570450432065286,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:2
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,4633501843546230655,2401331167625447045,524288 --field-trial-handle=2404,i,14618740337879516734,18325570450432065286,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,1399230488289116364,18214270643665597684,524288 --field-trial-handle=2404,i,14618740337879516734,18325570450432065286,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,13228588477618159937,3558269354705973194,524288 --field-trial-handle=2404,i,14618740337879516734,18325570450432065286,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,13228588477618159937,3558269354705973194,524288 --field-trial-handle=2404,i,14618740337879516734,18325570450432065286,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,845905758076123,3764044619198124147,524288 --field-trial-handle=2404,i,14618740337879516734,18325570450432065286,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4180,i,1414452922133949342,16152294012852446443,524288 --field-trial-handle=2404,i,14618740337879516734,18325570450432065286,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,4071807499341330869,468365025074733191,524288 --field-trial-handle=2404,i,14618740337879516734,18325570450432065286,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,11874992104219437044,4439590304242566455,524288 --field-trial-handle=2404,i,14618740337879516734,18325570450432065286,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4180,i,6405629482529761902,14381005976883738158,262144 --field-trial-handle=2404,i,14618740337879516734,18325570450432065286,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,2821023026305372022,12779259507910914648,524288 --field-trial-handle=2404,i,14618740337879516734,18325570450432065286,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,8776075996644022653,9434580690843191807,524288 --field-trial-handle=2404,i,14618740337879516734,18325570450432065286,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,5669158072289822647,9857514744078403186,524288 --field-trial-handle=2404,i,14618740337879516734,18325570450432065286,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,5623726141474403739,7518442876600606419,524288 --field-trial-handle=2404,i,14618740337879516734,18325570450432065286,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,16970468231833373791,4013828692341032654,524288 --field-trial-handle=2404,i,14618740337879516734,18325570450432065286,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,15917180346937225198,7374433319400528667,524288 --field-trial-handle=2404,i,14618740337879516734,18325570450432065286,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:8
  2⤵
  PID:3368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 a6673ce49b12fdcbb7d76835e1b016504a29767f7212d8e801c405cb7104ab24
MD5 ca6c08209c2d38cddd20d85d8c5dc47a
SHA1 cec1cabd103f18062e7cb4e4d6f0d8b419a6c0bd
SHA512 21049ac949a133b2d3655a743fa48fb77fd023763be431c403808d8b8cc86ade7133ad2fd2407bc2f19378bde77d294fb858d77ccfdd369434389ccbd4e515c6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T17AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c9e7f3921cfd612560e04924f37df223015782e414b6d5a7abd9eb2204833bbd
MD5 582d1872e3535b448911ea7e2bc06ae9
SHA1 e50539dede0de9ca78aeb92114d36e99c6667982
SHA512 c6b0bb3958937c071cbf45ba6a119f1c34ed35814649ff1f7332f7fc5857f930eb2ffa51dd1d868c430038c0d778d51d74fc8f2326c88491fc47f8d401a810dd
TLSH
T174E026E406C8C32ED250A6C75174670C92803B9ED6ECEE4A7B64888CB80A590FBC2590
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 ca4596e81fd1be01a777af766dc9c32a06083dcbae13de88fbe9786a663b8b2e
MD5 0825fc1258895febd1eb42fd1d213018
SHA1 6fbbb4eb6e1a3f012bded4fc8fc7cab26d75dd10
SHA512 357bb03215a374bbab2aa612e82b406ecaf004efc6dbc0fa793714aaa3c77f7dab3f0f0d46801139463ba81177c820befe74eecf39599a02042fd9fa946173c2
TLSH
T10AE0789415C8C62DD174B68741F4670C52513F6ED7CCFE1977F48458354D440EFD1551
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 a217c1f92f26c0d8bc3aecca0868dbe2d69ec33fa52ecab02c3f8b012ebf7413
MD5 eefb71925a345ef32541940f4e7508e3
SHA1 b30e34ec179712d8dc5553b2cca27856288040fa
SHA512 85cd15abab746a1297897cff92f36997e92ce0c967cf64de03f7198adecf436571155045a9a335c2ac471b519c1f7d28b5f62e6f267cb146d6d7a31ab55bedfc
TLSH
T1BFE0D8B417C7C57E8340E68B82454A5CC9127E47D78DEAD532C4E08D7C40000C75A490
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
MD5 886d3a2f30ae328537f8a8495b7ac587
SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
TLSH
T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6d2f8cd733a60efe833044dc7c595c7be6f3b74c71700eb013df81598904af7b
MD5 f829c905329d7797fc908002d2db3ab6
SHA1 06ed9a19c0372a25b7b236908e7ad511c8c4e1f7
SHA512 6e10ad95537ec0b1e1e97ec097a434121268ee41e5848d229fae91f520a2c9dc2686fd28d5c8336a3182734665829ba8f30c2fbeb4b1740265564910c7b35cc4
TLSH
T1F3811819930218B4CF231A7EF3D0061A35F2B4D8350BEF221680F97EB94532E8E77504
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b5de.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b5de.TMP
Size 3KB
SHA256 df9a632d63a1d2859eeabfb6a2785411f44ee451844530bd5c3e3af92456144d
MD5 8d41530da90163315bf8569ffe9fe9ec
SHA1 d17e140d6c133a20866a78bfff82746e087666d6
SHA512 20cfcfbf63c1b38f9a7d8d0c75c3b6b0c2d0c46eca94796f9901b6c3ed7ae1a1bb5031e314abd722f5cdece578f2875e3696126fa16989e7d7c55acd82c469a3
TLSH
T1EF616F69974208B4CF6316BEF3E0521238F2B4E8391BCF62159079BEB11676C8D7B558
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 44bb4be160ed0e1f95d3dcb848d044a242cbf4a889283ccd2b8d907d91d4f4a9
MD5 221aaeeccece2d820eb38a0958e62ccd
SHA1 dde1bf1990ee8245896cf3b1a5ed188205b97929
SHA512 abcc4969eaef849ad373301e948679eeabad892bfa821637c8526f2dfdffc0b13ad8f319e740669d35173400511bd8fce4dd878dd10cb434abf21626b047053b
SSDEEP 96:D/OnWNtOUOKvBlNzkPuIue0BsNRZZWmweGj4/l9:DWnWNtOUOKvBlN4PuIueQsNRZZWmHGjG
TLSH
T1B6A158F783A5822DC90196F4D715EF2FCE291614431C397A88D4BE67D3E2432E11A76E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 a8614c992afbfdf0f5024bc60863050f7c59053646ead801a71064b39aa18ca1
MD5 a222e95ebd073b8c179b5c0389e07a7d
SHA1 581b8a57c12232573880b35abb43bfbc382ce5c0
SHA512 0d5e9a01a57a40adaf6c8452d90c6d4d0f697be330657582e245b4742f930b74269484ff8cce3068aa26c2221d5d3ce01a30f77247ae637d5171faab80ca5979
SSDEEP 96:D/OnWNtOUOKvB1LzkPuIue0BsNRZZWmweGj4/19:DWnWNtOUOKvB1L4PuIueQsNRZZWmHGjC
TLSH
T102A158F783A5821DC90196F4D715EF1FCE291614431C397A88D4BE67D3E2432E11A76E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 a9e98c8914d28e53e596a11f90c8e6269643e5d6d37af09817f2242c1453289f
MD5 30706afbca18480d28a924cf532a7a09
SHA1 b3e41fedffdb3bd88a060ffee8d4dafc554825e2
SHA512 7d351b2dcc0fd248004b075e36e0bef610d46d0f66073a71e2c7602c587b6a6a6cf46746977703450a93bb385742a25b5bcd111438c61a43819d23720419c3c8
SSDEEP 96:DwOpkUcBHyWjNfzkUfuGRe0rVUNCa9iYmw+9:DLpkUcBHyWjNf4ouGReuVUNCa9iYmb9
TLSH
T1D8D159F7C3D9821DC80656F49716AF1FCE2D0A14431C3D2AC8D9AE5BA3E2871E21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 758e681a0dc4a01f8e6ce9c1eb3946e580727d3ac37f526f6423d42868d72698
MD5 e201b7f1dea6c78d5d23e0d2ac156c02
SHA1 69a1072bd8b1fdf7d4b5b16257a064b29e03b729
SHA512 284a822f1920dd56ff6f8d818d80af1c47304ee62e72703a299f8cb60100e2e8e38c6732ac8d501e864a54fd95badef283faba94bbd7d5b37d6e9a10a4695436
SSDEEP 192:sxZnRiyM/jK1Ml8UQsWU/fzs9pIdppBHW6+WNyCM/YwJEGbjIg5YJ:sxZnAqXU/fzs9izHbw/fXa
TLSH
T10252F812AA34AA77CCDBD209F945BF53D6F9447292940E44A9FCCA1C04E6BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fa20361f3c83d7ae01dd5192c5bb92e26d93df35bd6c72594ce1d395231a74de
MD5 1302c816f6d3beaeee1d661dadb4941e
SHA1 87de33eec2e24cc25baef56a5903e7580613759b
SHA512 840526433cfc2fa9f3cd286aba88febea61d78a2b8abd726b5d714bae422af567e75ae478d3340df3bdef8d5f3e30f5ba9368aa2d47d8596a6522fb2bd1c6a58
SSDEEP 192:sxZnRiyM/jK1Ml8MWU/fzsKpIdp7BHW6+WNyCM/YwWvGNjIgrJ:sxZnAuU/fzsKilHbw/hZ9
TLSH
T14F4208126A34A97BCCDBD309FA41BB53D6F9447292940E44A9FCCA1C04E6BED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 bd39656ee699bf50d3400568a18b4523de95147acef597710aca2853a469fa95
MD5 0a6d883bc63a5568fa53b95914892f0f
SHA1 2d9dbab6364ef3ec953ff55c4f3d2f5635e59179
SHA512 d730dd1766bf7e02fd8bf600a46c5b3a9bc3160c2b4adcc6e09274dfb70d37499ee3f11b3385a1befa67e755b65fa1aac9168606c62bc7d40fd8bac58c2f349d
SSDEEP 768:kx4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dqrohfcaaB:kx4jeXmWvmKLEu1jacPLZQdBSX
TLSH
T17FD20A3B280CCB7E4F844E9CED26AE976ED801CB6A584D5447FA494C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 1KB
SHA256 6941a06813eb3019f086ead4a6c84df193d5ad0e184258f7a013f17018f61ff8
MD5 b0174c2ca42996b9357c21bef99fc4d3
SHA1 9196c2acedb0772081e4b315b223d0f46cbc9033
SHA512 cf3ecc24bff63246f56a657629280d4f0f813bb4f23a7235856cedc744252d4a8f0ed9071f665b83b8f0bfc1dcb70355099b9164c8201a4cb02ec7112ca7ab3b
TLSH
T188314F8D8E84AD9FF89444B71473B8E8B370CDCC4720E323587C62722E1238A1A5B1DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ce5c4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index~RFe5ce5c4.TMP
Size 1KB
SHA256 5706e4b4e2440478afc2fa5c7a3eac7f4a8d2f90f692185a2c321a32da47b21a
MD5 5922e1779aac5c9fbadaa58805b2e8f8
SHA1 3457cd4e48e9a75118934ba026366f3d8f96b9ae
SHA512 a4daa393c1710b32820a824a392add621ba80e809f4d3e16dda735b4afeb9fcbe91eeb9f75eaeb9dbc204e78ab7b4056b3b6901678441e36d6f7e479ab5f37d2
TLSH
T10D31028A5A918D0BF884507B1967B4F8733588405325B393A97C62399D21B9D1B4F0D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 6231aa2c80254e9ed2d5ccac7bec7b37568f481cfefa4b3c65f747a3fa84a15f
MD5 619577ceae6ee723d37793fa1800adf7
SHA1 461834eb91246ce3ece5d0a6ee6f923dcc14b5ef
SHA512 7c4266621f7357339a21c556700d924f2714a8a5c36794e5932bbce13b611c8fc531f4f05b0eb302bdac0e78bc66fc2288f2acec2a94748582b715c8464a3500
TLSH
T132E068F62CD72E20AC7F47E228B204A84046F429C951AC8E2016E2E790A02282016C20
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cc2d6d6e5694c0c656032a3d8fcafacf0d844f89d33f7c3f0d541e29b15e63ee
MD5 2f318950c97605e4ac49a6a776837d31
SHA1 c82d79448aca870393d2f95a29396757770a9813
SHA512 9f119ef293ead1476a4b036eb3197eeef283f14b58895016112cca4140ed8aa158cf2ef78dbc29ab865198c3e8b4dad1feae501facd9fa1e4d380462b48c7497
SSDEEP 96:K41KKuE6mrmKsIbr0vbx9hA9laTDjAK7VDJAfTjqpLN+6vEq:oldSr0vbx9h+lavjXVDJWTjqpLN+6vEq
TLSH
T16091908A727F12113C3D29189190976B17827A63700CF47B7BAA10B64E6AE349DFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59304d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59304d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 aeca9efc5d2a343eb4ddcc05c9566ba7e53b2a1f22ae68599ff4bbb6e33aaf53
MD5 a9e5fab6343b5a318631b255a713791d
SHA1 2f0453e0bb1673131d9b52cd7a797b59135cd75b
SHA512 16af27d36eeb46f5805ef415b0da33059553cb2edde4f55e25e8f0ea97880354da266f3358489dba10e6208f3fb2e693022c7332038d6b6c4cb0b397080aa44f
SSDEEP 384:2ZcIhsN4Naz/oERduf+o8eHXo4Fwsa+VY/FBZmoG:khkjRgx3omwhg0FnmV
TLSH
T17A827E325D78AC775CE7A7C1F84726138EF8906796C9AB8492FC5B1C00DA6AC1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 cf8bd3a6e1280ee747d8069b64ac4dad4a3706388a51714d27a52028cdc6e403
MD5 b78a596a4beb926466c0a24e654d4730
SHA1 13e1a06ce08d1ed3a427f7a10f4cbfbf1001a2c7
SHA512 84ccbefdfc4bd8c60963c49a063dcfa24eae7bf81d7b97a0e7dce64ea2f9bb2ce0f68aefa81a128dc1760e11ab7197e8e14aa7cb46e333e960fde8c7c97eac7c
SSDEEP 384:diFiZcIVsNo8TUNTUlIloaz/oCRduf+o8eHXo+Fwsa+VY/FBZmoG:UFQVZwgj9Rgx3owwhg0FnmV
TLSH
T1FAC21AF248D79876D9AE5B83E77E2E028DBCC067B585A640B3D85A0CCC965BFC306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0fb408f22bdd42453b8287ac7f669c2bf892e2eb0b344bb354cb3c1b5ad7aee1
MD5 7fe74dab5b99868d3925e9c3266820f7
SHA1 31c83637979634bfe498cf1194a02bbdcd587a95
SHA512 43a3bbae16d09e47f0dd33d2edbbc95371aa46ba26a6f08a9d81741b91d72f6a35be59f2d199d2aac3a8a049fc970dba5d4da5bd084d19e58512684b961d4d43
SSDEEP 192:EONG6hZ0QmiUy9Npc/+jVSjzor9oZ5wOZzaU6:EONG6ospu+o8eg2mU6
TLSH
T19E02E83568686C678EE2AF45F48727139FE8113BEA956F84D6F81B1C00D779C2303836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4de73396144ac5ae3d687a989b2ecbb55b8b68184254c8d21b0f9e28ad03f458
MD5 02ac7ac6d51057588f7bb10a472ae8e5
SHA1 5af517cd4c8301106fdb7d405acbb7d8b1c5ae68
SHA512 b56051a05a96d3ff751840922f3a444511d4224e4b21c0f06b4fae3ddb4f144a4735ecab4aa4b0462258eedcbfc09a0c54e218ba98a18332d64dbe233683b931
SSDEEP 192:lON56hZ/QmiUydNuc/+jVSjzor9oHXLEn5cOqnqrU6:lON561wuu+o8eHXoK9wU6
TLSH
T14E120B326968BC674DD26A81F48735139EE9512BDE897F84D6FC1B1C00DF6AC1347C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ffc5fa93d9ed9d1f194922b48cc2df201f14f8f9de7bf5fc4a8ecf1db1b23ed0
MD5 d502ee5b01488d4edb9172d19001f642
SHA1 d827193bd783e1e3dcaad1386a80c48b6ddb54ac
SHA512 5cdbc97fc73d0246cdfe9412cf35f088897cf6e750c0a8d5b13a51db29d732f0ffd48cd289c5363d99bab4a4a0f56d31b33f611b633e2a955177838d92978982
SSDEEP 384:4ZcIhsN4oaz/oERduf+o8eHXo4Fwsa+VY/FBZmoG:Gh1jRgx3omwhg0FnmV
TLSH
T100827E325D68AC775CE7A7C1F94726138EF8906796CDAB8492FC5B1D00DA6AC1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9da37fff-4424-4175-a851-3dd1fa2ba8ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9da37fff-4424-4175-a851-3dd1fa2ba8ee.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a1e7670ff8be6df735dd568f6ce04faeea740e2c1ca7566818afa7d42bfc7188
MD5 b5a29b5cd20b0fb4529f2fe24d755841
SHA1 6ee8c3a38b4a20880545af655ea91b0f93f465f5
SHA512 dc13a2b2547eac1a3c8b948ca1f4bdfadb3ba1833766f9fc8a5e1fb95329b1f968d75fcd314af31fa0a5886570f418a479690ba0035d957467a0278d185994e3
TLSH
T1FD412359B6E91108B3B76F0AABF7696D587A7C772F07D45E10120E4F0A32A01C8A2737
MD5 SHA1 SHA512 TLSH

Submit Download