hxxps://gofile[.]io/d/ixKL61

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/09/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/ixKL61
Sample260919-tphprahb27

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
32	api.gofile.io
34	api.gofile.io
38	api.gofile.io
31	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1988	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134343080397792900"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{1232E980-B5C5-4397-BD1B-4A711063F025}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4028	msedge.exe
4028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 5344 wrote to memory of 4936	5344	msedge.exe	84
PID 5344 wrote to memory of 1988	5344	msedge.exe	86
PID 5344 wrote to memory of 2616	5344	msedge.exe	88
PID 5344 wrote to memory of 2616	5344	msedge.exe	88
PID 5344 wrote to memory of 4284	5344	msedge.exe	87
PID 5344 wrote to memory of 4284	5344	msedge.exe	87
PID 5344 wrote to memory of 4284	5344	msedge.exe	87
PID 5344 wrote to memory of 2544	5344	msedge.exe	89
PID 5344 wrote to memory of 5380	5344	msedge.exe	90
PID 5344 wrote to memory of 2544	5344	msedge.exe	89
PID 5344 wrote to memory of 2544	5344	msedge.exe	89
PID 5344 wrote to memory of 5380	5344	msedge.exe	90
PID 5344 wrote to memory of 5380	5344	msedge.exe	90
PID 5344 wrote to memory of 5956	5344	msedge.exe	101
PID 5344 wrote to memory of 5956	5344	msedge.exe	101
PID 5344 wrote to memory of 2220	5344	msedge.exe	102
PID 5344 wrote to memory of 2220	5344	msedge.exe	102
PID 5344 wrote to memory of 5964	5344	msedge.exe	104
PID 5344 wrote to memory of 1160	5344	msedge.exe	111
PID 5344 wrote to memory of 1160	5344	msedge.exe	111
PID 5344 wrote to memory of 1160	5344	msedge.exe	111
PID 5344 wrote to memory of 3940	5344	msedge.exe	112
PID 5344 wrote to memory of 3940	5344	msedge.exe	112
PID 5344 wrote to memory of 3940	5344	msedge.exe	112
PID 5344 wrote to memory of 3080	5344	msedge.exe	113
PID 5344 wrote to memory of 3080	5344	msedge.exe	113
PID 5344 wrote to memory of 3080	5344	msedge.exe	113
PID 5344 wrote to memory of 5672	5344	msedge.exe	114
PID 5344 wrote to memory of 5672	5344	msedge.exe	114
PID 5344 wrote to memory of 5672	5344	msedge.exe	114
PID 5344 wrote to memory of 456	5344	msedge.exe	115
PID 5344 wrote to memory of 456	5344	msedge.exe	115
PID 5344 wrote to memory of 456	5344	msedge.exe	115
PID 5344 wrote to memory of 4504	5344	msedge.exe	117
PID 5344 wrote to memory of 4504	5344	msedge.exe	117
PID 5344 wrote to memory of 6004	5344	msedge.exe	120
PID 5344 wrote to memory of 4168	5344	msedge.exe	121
PID 5344 wrote to memory of 3604	5344	msedge.exe	122
PID 5344 wrote to memory of 4144	5344	msedge.exe	131
PID 5344 wrote to memory of 4144	5344	msedge.exe	131
PID 5344 wrote to memory of 112	5344	msedge.exe	132
PID 5344 wrote to memory of 112	5344	msedge.exe	132
PID 5344 wrote to memory of 4028	5344	msedge.exe	136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/ixKL61
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ff8e7a0c188,0x7ff8e7a0c194,0x7ff8e7a0c1a0
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,9879556876239934149,10356993621249484804,524288 --field-trial-handle=2332,i,17974463043905269387,18239525030496628234,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,16681696573946883336,10948198722385273049,262144 --field-trial-handle=2332,i,17974463043905269387,18239525030496628234,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,15855134212138975627,9366890407242183536,524288 --field-trial-handle=2332,i,17974463043905269387,18239525030496628234,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,11120236913330919389,4323859246355093848,2097152 --field-trial-handle=2332,i,17974463043905269387,18239525030496628234,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,16136145375622085731,11515052308179179889,2097152 --field-trial-handle=2332,i,17974463043905269387,18239525030496628234,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,17151200939928412915,11929185975206858997,524288 --field-trial-handle=2332,i,17974463043905269387,18239525030496628234,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,2916211293876036601,16623656868209366412,524288 --field-trial-handle=2332,i,17974463043905269387,18239525030496628234,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,7210959127251692571,12510608714761350893,524288 --field-trial-handle=2332,i,17974463043905269387,18239525030496628234,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,7210959127251692571,12510608714761350893,524288 --field-trial-handle=2332,i,17974463043905269387,18239525030496628234,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5836,i,11439273816254765628,4915087926586604805,2097152 --field-trial-handle=2332,i,17974463043905269387,18239525030496628234,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6104,i,15999650343231159312,2912858243778818073,2097152 --field-trial-handle=2332,i,17974463043905269387,18239525030496628234,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6352,i,18107393329616290595,6260228946229842916,2097152 --field-trial-handle=2332,i,17974463043905269387,18239525030496628234,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6896,i,18308417477486575352,115449399143896119,2097152 --field-trial-handle=2332,i,17974463043905269387,18239525030496628234,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:2
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6828,i,15020756115785372653,8071951551325763452,2097152 --field-trial-handle=2332,i,17974463043905269387,18239525030496628234,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7072,i,14059661463827605392,16725804524769049230,524288 --field-trial-handle=2332,i,17974463043905269387,18239525030496628234,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,7477003813402813767,13099332079733828003,524288 --field-trial-handle=2332,i,17974463043905269387,18239525030496628234,262144 --variations-seed-version --mojo-platform-channel-handle=7324 /prefetch:8
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7004,i,1907752427892903926,3827234623300029209,524288 --field-trial-handle=2332,i,17974463043905269387,18239525030496628234,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7116,i,4189836398518917975,709977878836053349,524288 --field-trial-handle=2332,i,17974463043905269387,18239525030496628234,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,17447141566342202721,1838865036896865575,524288 --field-trial-handle=2332,i,17974463043905269387,18239525030496628234,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7108,i,11998769978862312359,7779503652511633790,524288 --field-trial-handle=2332,i,17974463043905269387,18239525030496628234,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6028,i,10760100936397600982,3867893059840463001,262144 --field-trial-handle=2332,i,17974463043905269387,18239525030496628234,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 d8ff59b4b05e1a602136dd7ff28aa60cff377de548396e9de494c915478e8b4b
MD5 67153f09310b85e98361ad49a1e1e9e0
SHA1 caf8403a8111922d48ad4d669a635ff4a87b16e2
SHA512 95159e8dee370f451339316237b4ca94373503e31412cf98b140335787998a6dddf549fe33ea844a118770f2f7e5ee9e3c0eaa2e3468a26f4c69e0d4f831a713
TLSH
T109F02DB5DD25BC3B08FC5B2D20541A46E751135B2780884B3B3D921D8FF1A3B854692C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 72KB
SHA256 4661b99deec46e6627b253ef5cdf6ea0677e30463d50cc61b2700dd3a00721ea
MD5 76603641df6823ed5813363615826c6a
SHA1 e95296f27c36dce1ece3add884b3f6c2c0ee4200
SHA512 30cd5120f3f97c138e4ca19ca6186bed24db72691787b3da50e1334296b8e4142612de329e167591c629f236675df0ab0a9c1e5e1923b16f2f454ef18373a442
SSDEEP 1536:dgtiO8VyNU9mnSxEsMYLbaiHuVF8G26YSQ5xmdRRgfHimOCQb8:StJ8VMMqOMY3aiC8GEmdRiCmOC88
TLSH
T117731220A097A859B96440485D55DFC9A89450E187ABFC8B78FCCF7B70030A5DDB7FCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 46KB
SHA256 96b873f3ace1ba8292595597a5c3e266edbb0c3b49925f311eb2eb8974a96829
MD5 fd92f9126331037471c2d41a177d1d60
SHA1 430123ab0b84ff847e31d56e08ac37112b8d35f2
SHA512 519bd5d52746fde5ea1922ad844241fe1e28e664cb5c02122784e3edef2eea6c816615f7808cafb8bb2e488cba1b7459e1d7b833d6576048b6cca38ce3d28ba2
SSDEEP 768:ZVLmaVLcebfPPWPpvIxnkzBFkSCRqszQjmebWfZ6LuTfGzE9BxEvqEyeIKiv/czV:ZVL59zPWPhIlABKTKFuTxPx2Gr7/qgEr
TLSH
T1972302C08A85F0ED6C8C8478487DFA47F15496D5B4206A89D330FB7C89577A736E8CB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 f87da21a4b06370db7f29f490d120c958a5bf2ed50f0d034fec7f0bad839d7b8
MD5 64aca8dcb14ef0f60098054a07d99100
SHA1 5cbed0222c17f268c28f6c43abf445017cd02275
SHA512 056474b338b9b1f4b981b2e56720d9b0aec8b8d8c43748f618498441c8aa15ffa90e2c1d1122b6f59ffc5666488ea9b76eac74b1afb587defec97a34beb89a59
SSDEEP 96:sHxX5rM1oXPqe6f833GOqTW8yr/zfYk6ct0RbbRnt+3q2N/dt:sHxX530UV81yrbfd6ctgbNt+B
TLSH
T173C1828191C27019EBDBB23416BBADD8387521FC6B835A9F52A3EC34136FBF60943850
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe595b07.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595b07.TMP
Size 3KB
SHA256 8fc1167de4e9eaa68d2c797e994d83b59a900cd1532f9c57b2f31077874ffefe
MD5 5bfff95df1463a01d22d54a642332fbd
SHA1 1571bc42c65e2f69213ab0b3e1e540581aaed2d4
SHA512 f13e4c94d82626383efd2729adf1b74464b27248193e42d37e9733a266b80aa296d56b6076d30599de3c3247f66907621310ef371822469cf4af002e090d0d3e
TLSH
T1BA61A6858843B427D7982431A3DF72CB393578B1B5E7ED1207ABED768B4E7494D47082
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 be9a796123129815a65ce2e3bca6ea5f3f7ea7b60d3446383f67073e5675e853
MD5 706ac2e87afc0af4fab9a6512bb0d366
SHA1 ff52f47ea8e04ce0909e550bc82f1f7403cc1584
SHA512 bdd5ead7b0a1d6136f3e028e77e4b82e61c4cd0f65c323229bbed8184934d0453cbc5af267f70d9b8062feff290d8656b994794fc7f93f19a065357e46571cbf
SSDEEP 96:D1HOVdCjNavHVwa1zBSP+yYgzc5GORBwBHIXtub/O:D1uPw8dwa11SPhYgzc57HkoXtub/O
TLSH
T128A1BAF7C3E5862ECA1191F0AE146F1BCE2C0956436C7D5A84D46F1BA3F28B1E141B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2733b88d2d2db6b2b75931fa6bb5f44dd92325d3a99333df04ee58cff0934a0a
MD5 802c44716a8a8bfc572fdb2cc0896ba1
SHA1 682d8c1f394b7c16a0e8be9294befd32803b9f14
SHA512 c03bb382fe0e705464f08bed62ea2219a06897be4681b8bf0343242a09b3daa2f1ba54b0b453996af41d009d1731b02c5fa81b11490c76319c437959eb6576ec
SSDEEP 192:sxZHRVWOg/fdsQQZZWjjodp4flQHW6+WNex41q5G/YbI3FY1kyIg5cKaJ:sxZHCOg/fdsQOZWIbHb7l/FVY1ViL
TLSH
T18442E855BD38A93B8CC7D219FA55BF53E3F9603290951E44A6FC9A2C14E7ACD220341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 622308bef8b09085dbbbc1054a5a90719399e146fb3d849b5fdf800721e2439f
MD5 d9c24229c002ca6e454ea6736905e09c
SHA1 69c0d9f19b88f3448ff23a4abfac78698bc9a011
SHA512 73b9004b1981e3917e9e8825251a03e2b6f891f05f28a3808963346442c37913974e97a72b3a5b67bff9218e4f10d50e26cec4d5aebe6c640bdbf02befdd8fb5
SSDEEP 192:sxZHRVkg/fds9QZZWjzodpRlQHW6+WNex41/YbI3zFY1kyIgjKaJ:sxZHAg/fds9OZW4UHb7/F3hY1VjL
TLSH
T19942D815AD28A93B8CC7D219FA55BF53D3F9603290941E44AAFC9B2C14E7ADD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 a0bc4e217eef757bd674804e683414814db345a3ebea9c8d9c0dff9bd18a6198
MD5 19c009e71778e20594a773a67d280d14
SHA1 ed6f2cd5b455b39dea40aa4e31e12229457589c1
SHA512 1f56fbee93acfb7cb32335fff319cc5b28a2dec21be782ab62a38355f2ad8cd053c15a274735a43dab26ee0846ced0b7b1d0f92e5842d30b8f62aef4dac9bbcb
SSDEEP 384:sxZ1COg/fds0OZM1/FdHbil/JAEY1VilDpwb:sdVg/fzB1jHbcJAEQqDpwb
TLSH
T1AD72E8566924D87B8CC7C518EE35BF52D7F910239C954E4CAAFCCA2C14EB6ED220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53e20c77-b467-418e-bb80-a15e6e208f91\index-dir\temp-index
Size 3KB
SHA256 b0a00b5cef458bc055fdc230ab0ff07570bfec3775594e7f4488c04d7f9cb990
MD5 e55fabe5671c4a3c0c5a5635dcc891a8
SHA1 c7850a73f36a4d54e9e3d8dc455cc171af7f48a3
SHA512 1778925ba446494a5abfaec3a5fa1e661a254c5aad9782130e2ee83e3a7b17b37d3bb892efc4db88ea1dbcc1236ef61504d9a0e1fa898aa631907ee5e9cb9329
TLSH
T1A751E70F8D476BA6DDAC56B218B4044A337826DC13441A2B94FE4238FC836292C5DB59
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53e20c77-b467-418e-bb80-a15e6e208f91\index-dir\the-real-index
Size 2KB
SHA256 2933ddd106eb7007c0d15c7684e91bc9238406963caf8827f05944221384ff53
MD5 854f809d7bf2db3d3c9ae7de0698a839
SHA1 95f194fcd2fb15f30aeebc4a422249949e98e2d4
SHA512 9981b836e8d8a5df292d6eec6a5c371d42d48d1badea38fdfe1b1ae7df357329e8d9fab2d874cce818930339b4a1ae15d677d6c76b06d0cf8bc1e6e93d0527bd
TLSH
T1CB51F84B8D030F2BEE6846701878188D3734A0DC23882A1B95FD9139FCCB7046C49B78
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ed1a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53e20c77-b467-418e-bb80-a15e6e208f91\index-dir\the-real-index~RFe58ed1a.TMP
Size 2KB
SHA256 54c6da9a23546a0a1422eca300e9a60b23557d5b40ab605b2cf75d78c4a544e5
MD5 39bcc0efc32c6b13495e61a4bfc56c92
SHA1 b094fd99e6805161567ab79874b75928f7c56248
SHA512 f3284694d659639b14b166bf09e0ee0ad500bdef2e2ebedaed8095de126842177b80ff3f4251132cb3593421abd27bb0b57ceb2b4cb9f4bd012652829e16c6a1
TLSH
T1605183664D02473AE85451B309AD1496333AE58547882F0F72FDE136E8C2798BD95BE4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\98461db6-76a0-4b18-b245-cd79036d2401\index-dir\the-real-index
Size 72B
SHA256 2dce0feae21f91957f3c20dc52d8cf8ec45eefeff876fbc781493253aaa17add
MD5 908d3827ba6e13e76174a6c595ccddea
SHA1 3080c3e4474a18e55996b025120bf57d200a61e1
SHA512 e1e528c18e306e03da7583a68b49edb2a3a9325fac33f1554e2e5d71b0b5f261ba886ff1f552746610fecf318e72a042fa2ae37dfb68cced593b8ae3177767f6
TLSH
T190A002A65784204FC022E1B5295642A12306F8261500130740914444CD565404FB304C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\98461db6-76a0-4b18-b245-cd79036d2401\index-dir\the-real-index
Size 72B
SHA256 781e7a91cb4d95a1253787374258e9d5fe9471243cb7e04622cfa6386c69f889
MD5 84335dcd914b2ba3024d649c28c28684
SHA1 d0a142669095440ac752f49c0687683f9d740728
SHA512 19a9643b2d018117fc0bf367d1ea2bdc4cc77b249f43fc592ad93fda4107a96204b6b72a25912902ce0d0799e711ce35b465a40b04569543a1e9cf8c3e48b338
TLSH
T122A00294C2D00009D28A5BB82BAA034737E0CAAE0705175F81A28889EC509865D6220D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 0fbe2751f00d86f83fbbf7b36382d7e5c3ec9611bc0570a0d4c6f8bf38e0a595
MD5 5f2fb9edb9980dd404cfe3546a237e9a
SHA1 f69ecc85a178942458967ff969639bab5dc7199b
SHA512 eaea7bfc8a5b2787d56dfb9149dd982a9fd6ada2c5c6477df493d1f90e40cf83dfc50486b06f4d2d6f3f8255d3e14a957777ef003cca511fad1174e6005bf747
TLSH
T175E068B62EAB2924E86BC7D01CB200980242B8644894AD1E842DE6C330A22502566C33
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 d107ff705d1f92384ee675b69286e8015fb74866a1ce09847ffc61b495144a27
MD5 d70f194b32a7aac0243dd93c62fb06a6
SHA1 429344905668f5e640d842b975d72eb51ea41d47
SHA512 21412cda22ec102f6ebc9da4cda29bfa00152ea64e5308f6176670077433a4e8705ec9db56f95c8fc3b738759ef311c121b4a9d3d3f7fd2c60ead5bf481946b6
TLSH
T187A00223CB59B041C44026B661F69641B3508CED031D131784D8E0988D9168861C21C1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59454c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59454c.TMP
Size 48B
SHA256 3528020334a90dbac16c20f5ba2c202c8b1a7a22c8016d065fed87d4a5d386bb
MD5 93d9c0f5a981aa541aced8fba50770b4
SHA1 d8517ef036961a0b9afe7e11986247e77c81d208
SHA512 94c24a4e62321adbbc5277fd87072ebafc8b6eb385f5a0f89e0f2abad651988ad0d9b398792b6f879f7b40fb7ec4ffafb1f5ce50ff19b68fa1a2f799fb6751bc
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 24aaf18a624cc0028730827ebaaa0bbdb3c8ebbcc09e593c57ea14f6b6eec7bf
MD5 002e00743ed0d538b91d57be81f11e0e
SHA1 fdc40efcec0ec079451026a9202ef31146cd6807
SHA512 e1e7065f093db8a5e467e2314f4aeff6ca24ce313b9dc3ebcda8650e037aa341e99515aba4921400d4614ebb66da97c46aa49d85a525c7cc83d4e831782e2c18
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvX47f9:OtfFvpopPxrB4Rhf4T9
TLSH
T1C4B2331471BA121038FE790C81B5972E464232B33259E63B7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 20a81a89043c357b91c440509b62e98a3415113b2e232227807d2a2886452a3c
MD5 bc7b999337252625cb5ce74faba45541
SHA1 d2e40fa227ad8cab08fce29d729c72fa29c00b0a
SHA512 189405dfd85aa8a9a19e0620dfbdf393b2c016316038b905198ae87c1d19d3d8c66ff5ea4a6f2e0746909f014714a5c1ace59b003a836fbe2a7b658a3db0d06c
SSDEEP 384:nfiFiZcI63sNF8TUNTUlIm25mg5RnK2flBVTPUVDb7O6R2FeoCWgL/7Izgow:qFQ63AwgSWJBVTPyb7TR/N3
TLSH
T1B7C23B36EC68C9BBEDFA4F9AA70A7A07DEF40163959C8AC0D5C85D1D009759D130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 559b976ca304807fe3ca9c2db9e66c4e47d325d7207c795280b2c200b476bd6b
MD5 2e3d88d9d43165b5b2374265e1157e76
SHA1 a1695942fbeeb51d0ed704c5fc3032ab8351e92d
SHA512 9b09ea439e83ad246d7b4f0f678492aac3811cd11c5820a4ea993b8ded2b5bcb2ecf1959dc79f7b2e0e7cc9f051c3f79cc4de2b457d5b80bae205e16e6eaedf1
SSDEEP 384:nIiFiZcIg3sNx8TUNTUlI4zuT6mgJ7J32K2flBVTPUVYBAU7O6R2Feo1gL/7IzCR:TFQg3MwgZQt3MBVTPNv7TReq
TLSH
T116C25C32E8A8C9BBADEB4B99A70A7A03DDF4415396CC9AD0D5C85E1D00D759D130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 3ea47a3558e33bc5dd3e60c3fd26dc2a07cd9c5191c8b130be36bd0786e7ea7a
MD5 a34f7b579b1407d225c48d5531624f53
SHA1 41db28d03d6e6a4897fde201d527fad2fa76de8e
SHA512 c333f51092760aaf50c319159e1c2b2b5eca809627c712e9401ac0e9bc5781ae83a91ee830504b3e93198c8db170cb6f8facdb69798c874f0d1e087d3251ed2f
SSDEEP 384:nEiFiZcIeC3sNx8TUNTUlI4zuT6mgJ7732K2flBVTPUVYeAU7O6R2Feo1gL/7Izm:fFQZ3MwgZQH3MBVTPyv7TReq
TLSH
T136E2B3F1A8E789B6E9EE4B97673D2D0299FCD113B1884580B7C81D1DCC961BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 fe65e7e728ca88b7274a520d7e8844df85cf6e610734a520f8d591e615f7123f
MD5 6a2b529acb59d4c5a6c467e247cde07d
SHA1 cf4124079fc04adf8c78845db82abf5a1d27ac51
SHA512 862e2496fddf5174352a65312e880da57602ed6c4c75f95ccfb63f2a1d4487ca2ac12ec00945dedf4338b1df767597a1f50b58ae7f77a241cc682f16ec3b04e8
SSDEEP 384:nwiFiZcIg3sNx8TUNTUlI4zu5mgJsg2K2flBVTPUVYBAU7O6R2Feo1gL/7IzC5oq:LFQg3MwgAQhMBVTPNv7TReq
TLSH
T1D6C25C32ECA8C9BBADEB4F95A70A7A03DEF4415396CC9AD0D5C81D1D009759D130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0bfcbe342d5e2a97284207e464da5c0ef25babd92ade081ddc91d871318a2cde
MD5 8c78021f7754a90bc66d67dd8d83026e
SHA1 21da9713d0d0f788ee54bfe7e83cbb621d717431
SHA512 5322088488252b2f5e5bbe868a1a08add4291fea821344137597179f8f2aef1559d24c94338a7231ae5f531bcd78120cbc6584ee0d19ae5772b132b7ecbabbcf
TLSH
T13641285CA6E92158B3B76E5AAFF6A82E547B7C773E4AD49D00010E4F0A37A40C831737
MD5 SHA1 SHA512 TLSH

Submit Download