hxxps://script[.]google[.]com/macros/s/AKfycbwSo5Jrsm_bIYJD6urICsxfzn8ZIaMfh9sTR5qDgbONnGnpn2hi7499EITd-5_RdlwcTw/exec

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 17:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://script.google.com/macros/s/AKfycbwSo5Jrsm_bIYJD6urICsxfzn8ZIaMfh9sTR5qDgbONnGnpn2hi7499EITd-5_RdlwcTw/exec
Sample260922-vwp8vabc97

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
101	drive.google.com
102	drive.google.com
99	drive.google.com
100	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1140	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345712453320896"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{EBD8E10F-4882-4975-A45B-7695FB69315D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3396	msedge.exe
3396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 1420	4660	msedge.exe	87
PID 4660 wrote to memory of 1140	4660	msedge.exe	88
PID 4660 wrote to memory of 2764	4660	msedge.exe	89
PID 4660 wrote to memory of 2764	4660	msedge.exe	89
PID 4660 wrote to memory of 2764	4660	msedge.exe	89
PID 4660 wrote to memory of 2360	4660	msedge.exe	90
PID 4660 wrote to memory of 2360	4660	msedge.exe	90
PID 4660 wrote to memory of 4504	4660	msedge.exe	92
PID 4660 wrote to memory of 1812	4660	msedge.exe	93
PID 4660 wrote to memory of 4504	4660	msedge.exe	92
PID 4660 wrote to memory of 4504	4660	msedge.exe	92
PID 4660 wrote to memory of 1812	4660	msedge.exe	93
PID 4660 wrote to memory of 1812	4660	msedge.exe	93
PID 4660 wrote to memory of 1596	4660	msedge.exe	94
PID 4660 wrote to memory of 3264	4660	msedge.exe	95
PID 4660 wrote to memory of 1596	4660	msedge.exe	94
PID 4660 wrote to memory of 1596	4660	msedge.exe	94
PID 4660 wrote to memory of 3264	4660	msedge.exe	95
PID 4660 wrote to memory of 3264	4660	msedge.exe	95
PID 4660 wrote to memory of 2700	4660	msedge.exe	100
PID 4660 wrote to memory of 2700	4660	msedge.exe	100
PID 4660 wrote to memory of 2700	4660	msedge.exe	100
PID 4660 wrote to memory of 2600	4660	msedge.exe	101
PID 4660 wrote to memory of 2600	4660	msedge.exe	101
PID 4660 wrote to memory of 3108	4660	msedge.exe	102
PID 4660 wrote to memory of 3108	4660	msedge.exe	102
PID 4660 wrote to memory of 5088	4660	msedge.exe	104
PID 4660 wrote to memory of 4208	4660	msedge.exe	107
PID 4660 wrote to memory of 4208	4660	msedge.exe	107
PID 4660 wrote to memory of 4208	4660	msedge.exe	107
PID 4660 wrote to memory of 2876	4660	msedge.exe	108
PID 4660 wrote to memory of 2876	4660	msedge.exe	108
PID 4660 wrote to memory of 2876	4660	msedge.exe	108
PID 4660 wrote to memory of 3324	4660	msedge.exe	111
PID 4660 wrote to memory of 3324	4660	msedge.exe	111
PID 4660 wrote to memory of 3324	4660	msedge.exe	111
PID 4660 wrote to memory of 5332	4660	msedge.exe	121
PID 4660 wrote to memory of 5340	4660	msedge.exe	122
PID 4660 wrote to memory of 5348	4660	msedge.exe	123
PID 4660 wrote to memory of 5560	4660	msedge.exe	125
PID 4660 wrote to memory of 5560	4660	msedge.exe	125
PID 4660 wrote to memory of 5560	4660	msedge.exe	125
PID 4660 wrote to memory of 5632	4660	msedge.exe	126
PID 4660 wrote to memory of 5632	4660	msedge.exe	126
PID 4660 wrote to memory of 5632	4660	msedge.exe	126
PID 4660 wrote to memory of 3868	4660	msedge.exe	132
PID 4660 wrote to memory of 3868	4660	msedge.exe	132
PID 4660 wrote to memory of 3868	4660	msedge.exe	132
PID 4660 wrote to memory of 5240	4660	msedge.exe	133
PID 4660 wrote to memory of 5240	4660	msedge.exe	133
PID 4660 wrote to memory of 5156	4660	msedge.exe	134
PID 4660 wrote to memory of 5156	4660	msedge.exe	134
PID 4660 wrote to memory of 5156	4660	msedge.exe	134
PID 4660 wrote to memory of 5548	4660	msedge.exe	136
PID 4660 wrote to memory of 5548	4660	msedge.exe	136
PID 4660 wrote to memory of 5548	4660	msedge.exe	136
PID 4660 wrote to memory of 3612	4660	msedge.exe	137
PID 4660 wrote to memory of 3612	4660	msedge.exe	137
PID 4660 wrote to memory of 3612	4660	msedge.exe	137
PID 4660 wrote to memory of 4308	4660	msedge.exe	140
PID 4660 wrote to memory of 4308	4660	msedge.exe	140
PID 4660 wrote to memory of 4308	4660	msedge.exe	140
PID 4660 wrote to memory of 3396	4660	msedge.exe	141
PID 4660 wrote to memory of 4572	4660	msedge.exe	142

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://script.google.com/macros/s/AKfycbwSo5Jrsm_bIYJD6urICsxfzn8ZIaMfh9sTR5qDgbONnGnpn2hi7499EITd-5_RdlwcTw/exec
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffa2243c188,0x7ffa2243c194,0x7ffa2243c1a0
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,8084602129281941092,10228254008198791138,524288 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,4214538609311330176,11074362961996161170,262144 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:2
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,5794867775080343487,2097754635023656167,524288 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,14249221970610076823,3609445682824952202,2097152 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,18240514409587459954,7412319063866629358,2097152 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4108,i,10777799370752237524,16427826915433145386,2097152 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4160,i,7297145757685202896,14047245605342807271,2097152 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:2
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3604,i,6461265447011145454,17991071412616195254,2097152 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,16663307145111274550,15053730378942749598,524288 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,13142319362824463231,11014337914973677450,524288 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,13576733434083922829,1951087910896281659,524288 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,13576733434083922829,1951087910896281659,524288 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6416,i,17588176432130672580,8270218254113029537,2097152 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6524,i,5878657916538317597,17398158577903279882,2097152 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5088,i,8004485656571692303,896827139552058578,2097152 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,15616592979187064627,17821836434197766244,524288 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:8
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,1184660013368943786,4503395797281231860,524288 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:8
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,18034459089178845492,8185042821937804557,524288 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6880,i,3469440223073969338,5864499862891710017,2097152 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6636,i,8592658026347687490,2983615061160682338,2097152 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6912,i,4679609942600264892,7723339680533337297,2097152 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,4122961435369294235,12395431776251266345,524288 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6660,i,8213542815615832720,8418609377183778965,2097152 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6512,i,14028521405306377024,12155375696274328675,2097152 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5840,i,16417715002186615538,6694342816710529145,2097152 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=2084,i,12323813509024979317,17849444428952922805,2097152 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5840,i,969178743929131488,8097462392674882488,262144 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5096,i,13783838716358257052,2131969526115068907,2097152 --field-trial-handle=2628,i,8901601468688436300,9995497865125517569,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 345KB
SHA256 af74444f93c1a87703c134e8e3a1762932e8c9ed17b5781360a51435080b8704
MD5 a3b1bd33206689c75f9acfb640a6ef7f
SHA1 88d1a94a23fc0b9702d6857e71038d5c01a0bc27
SHA512 7d2ab5783a9640015ad2215944cf3bff51babf2ca59fa0ee7e2e587c1ef56901b6ddb399c2a435757aa66bd2d5c7933326c606df7942d354ba6493c51c49acfa
SSDEEP 6144:dt6B0ZtO9WZMN5KSdoaPiC1ghYvx4BmlxTbD5FuTbb1cc:dt6B0ZtCWA5KYP8qvx4klZqTec
TLSH
T1927423E3AC113A4A630789E74DC8A1AB7453C5C32A56FF4237467887A6D8D8E365CF13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d72f2289e4e24989f7d0d00d621f9414a9627c27d01a14f9c576552f0cb2545f
MD5 5c4fa8036a8f27086644e8ccefb7f05a
SHA1 b29722bab263ff08d26e3f4cd7e9f49a17c2dcd7
SHA512 5e87f38e0ad7846a56c0c92114db69601f976de9e58e588a977f3678cfcd5caff73a34dc1eff3570390c32ae8d238928b158007e79bfd9f1224dfa6ae6a794c1
TLSH
T1B871DAA554E09621FB695D70AAFC3287373A8BF90BC34F820954D578DA19F3170D6F82
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 ae31bf5643f89dfd2aa95bc2fab1a328d49e1c2e604862bc56eee2c58b8b0a89
MD5 af1714e3746e9eb7b75ac861d7bd5143
SHA1 019497ca699a02d43a7eef70e2e1686fb5ec4568
SHA512 395f525aa90d5ed848d3dd1751a069222188c5d87efd747d25630fb46975138bc19453e8f96dbecad0b7adf87f8abef5bda313ced777ad6f73ae2fbb16ed16b3
SSDEEP 48:YALlNjBOhSxyJQyTy6hVPhphphbhsss/s6kKsgisVZsI6saXsvC70Es8kzsTs4s7:DPOalMtnbXRKj/bzgSG0YVsRqZwT4g
TLSH
T119B1ABF7C3D8C12DC91156F49721AF1ECE2E0A28432C3D26C8D9AE5BE3E2471E11565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 d807599fa082876182e9511bac907707f720d7a5e771bb0e887d9dd4735c6cd3
MD5 d64768f9cf36ad78790e15a581005600
SHA1 6988133f1d0a4f6dfc8b2206661149158bbe0260
SHA512 95ee4e44d2544845744634985c89c52de0efd6ada9ff8bce3cf011966da2d975f355617a2a5cc7c34880c49a572cd7ddcc62a5974a807abb16ab31deaf16f68c
SSDEEP 192:sxZRlW+/fPsza4uIdp7MHW6+WNzbQ/Y3Y0oIgrJ:sxZRM+/fPsN/QHbg/X9
TLSH
T1F622C812BE38A57B8CC7D21DBA25BF53E6F95032A1D51E48AAFCC61C04E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3ad1f270227ba748455098e046c839ff20bf57885c842d276e7c65393f44ec53
MD5 fdc504a753408eedef5105e5e4f1d52d
SHA1 b90fdaff7600cfd8a5236fe0d0f9ba5eb07a4eae
SHA512 054cf52605c2595ca8278eb5ef669755633caf2c9cc7ac5e3f3e857a8a69503d7da85e4f2308c1a22a7eb3fe0ec362caa7f1d7df0102c28ba37a087b9cf71f73
SSDEEP 192:sxZRlW+/fPsva4AIdpThMHW6+WNzbQ/Y3Y0oIg5KJ:sxZRM+/fPsxBWHbg/XI
TLSH
T1A722C916BE38697B8CC7D21EBA25BF53E6F9503291951E48A6FCC61C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7dfc7d7fa97536de26f8ef1951c36d46bfa04f417aeb47f7c34f0af188962b39
MD5 138acaa179cd55fe6aa2c912b402bd18
SHA1 cb2c790aa7174b09d8acf1ac35d8c1a80d296207
SHA512 e7d2f71bd137e647d0c3b7c34b842024b85d8f3fefa5e567a018bafd026e0b8128342abc68eb5ca0b3e0ac1e89409f993f31cb40fbe9975aaad7100dcd49a203
SSDEEP 192:sxZRlW+/fPsvW34AIdpThMHW6+WNzGSXY3y0oIg5gJ:sxZRM+/fPseIBWHbzX3y
TLSH
T1C022C816AE38697B8CC7D21EBA25BF53E6F9503291951E48A6FCC61C05E76CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a3c80683acc58f5f772c65251533f6cbeb06cb0d7179ed1cd822e63d7e13f4a1
MD5 ed44b607ab9487d7e405934e3d594a87
SHA1 95391a8716a78277b5032127d3ef49edf739a7c8
SHA512 4fbd5192f99a18c2bf04398206a2e87f5c723eb24998b20242c3a6e6022091a3f6896dde7cd85c0ea198c9871057e9cca1890c106c9f65ead64897a39d7ef58f
SSDEEP 192:sxZRlW+/fPsvW34nIdplhDFSHW6+WNdUbvM7/ZY3p0oIg5gJ:sxZRM+/fPseIooHbWIZ4y
TLSH
T1A232C753B938697B8CC6D21ABA15BF53E6F9903251D11E48A6FCCA1C05EA7DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9fe4849afcf481e357ab06b000de13aebb7724a7cd82b9f41f07e44e9ac7a0cc
MD5 3ba8d5dc61a92ebb33f14c9fedb175fe
SHA1 1c45b6fe0184e0b5940242a3566e1acde9352f5f
SHA512 b8be0be10abf0ce43fb40b852c8597e1d96b401902116c430ca130cf59eb6aa30aacd2568ca277cdaa440e9c5660beb0e39098ae322352fdeb0f153a217174bb
SSDEEP 192:sxZRlW+/fPsvW34LIdpThDlHW6+WNdUbvM7/ZY3H0oIg5gJ:sxZRM+/fPseIU/HbWIZOy
TLSH
T14332B752BD38697B8CC6D21ABA15BF53E6F9903251D11E48A6FCCA1C04EA7DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e2866382f7f5fc1158377cbf3d4a97f96bd1ef3b854ec4714ee4ed2e5447ccba
MD5 0474330a690e2c8120c61107c8721e59
SHA1 c650683a18344506a1d3578d5552f6b9fbfaf033
SHA512 bfe10f6f81762b428ef9572a1db60b6f6e6feda86e6fac81c9c04f0058d2e4e61080feb2ce1d2f0caec9554492ecfa8c462479d59e2b12bf2f9b527ee0951555
SSDEEP 192:sxZRlW+/fPsvW34LIdplhDFNHW6+WNdUbvM7/ZY3p0oIg5gJ:sxZRM+/fPseIUHHbWIZ4y
TLSH
T1AF32C757B938697B8CC6D21EBA15BF53E6F9503251D11E48A6FCCA1C04EA7DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 dede653f9f9c2e2cdc813d5f56519c2add50023b9ea17a4b638b1ebb2e7277b7
MD5 1f938d44f0ad9a71fdb11d9f7af34644
SHA1 b101d5db1cb14a879dcb26c0b9a547c6d29e2abd
SHA512 864a1a00812aeb54b867df000e53beafb80c416b5abf12fe28378ee90456e215177eedc7b18a7dfbadae1be27e9866944123d4e7b1dcc6e9bc14985c170d53da
SSDEEP 768:Tt30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72crolZMF:Tt30AbSWvS2l9u1jaLmLZ12Hm
TLSH
T1AAC2EB3B640CCB7E4FC05A9DDC6AAF9B6E9C02C796648D4047FA984C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e392aabfa620d0397691f7d2c0b76b9ec915e11090c2048b4b96fad24ef366ad
MD5 55bd0a1270de1070e6b01b24730cb3c4
SHA1 b92b591e15b62d0e6310744eb9fbb32de61cce1d
SHA512 01196ce8ef5d81c506fe4af4f9586ae651baac456723848daab318626157fa65f8b906a4665a172d9c049bac715c531090bca1764ccf016b447a1dbbec57180d
SSDEEP 48:KA5ItKSgIPylrIVKMU4CQZ6eQKqxb+LsIA2xKp4BwxlohiD2qSyFz:KA56KSgqurqKMUflCKWsiWz
TLSH
T1CB91018272B712413CBE651D80A29A5E029239B3705CEA6F7FF944525E27F080DFEDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e278fc2b4c92f483572f444f30501fc45116cd01a173382fba6244479818dd04
MD5 e66ae56b5a0d33456b325bede19065aa
SHA1 6a2d9bb333fd91e58b5d508be067e284c3a9f095
SHA512 c361761fa458169e7781345114e32ae9def0c2f916179dcdfb2c9a411e1e38bbf0e5ef98acba35b927184d250cfdef62a49a74d8fac80c361fe4521e4fbfc660
SSDEEP 384:NZcIhsNXtpE3Epu6EFS9iX5FF+Ucc+sa+VY4hG1oq:Vhn3EKWaZBB+hglhit
TLSH
T1F0828D72AD786C7B88E2E292F54739039FB89167D7C86E84C5FC9B1D01DE5981307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 54709d70de270ed9b7cd0bdcc0812a93f19630b634272cb2b0684d80fe77bee7
MD5 971c1f28de71bb5e63068b56a17038dc
SHA1 2a992c72a7e3dfaf0a93063759149b18ae19d7f2
SHA512 c95c750c31657c6fce63ca87f9105b1685e5c3bd5303768ff1a70e65f9c9f392171f81113c84ec63b7a7ed3e4787cdbd6f09851e5532df8425d60b5a55b25e94
SSDEEP 384:gZcIrzsNXIpE3Epu6EqW9iX5FF+UcP+sa+VY4hG1oq:e/A3EBCaZBU+hglhit
TLSH
T136828D76AD786C7B88E2E252F54739039EB89067D7C86E44C5FC9B1D01DE5981307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fac3f84909380e8190d13f73a6e494c2aebdbc0a6ecd42cf7b08deea375048fc
MD5 fd57c67fb5d9f03405352d2019e38e0d
SHA1 57a11ea50549f6f6a38bf85f77871bad3bd70711
SHA512 a7944e37d4837e16b6dc29243d8b5f59cc1e89e8f21d8cd0fec80c1465c5e5d5e7dc75835e3052edeb04c4f225677a838a9327794f77e532d70d614117f93ff3
SSDEEP 192:LONS6AmwppQmiUyysmOsiX5FSY+UcXeIlRRs/HdU6:LONS6ipH3JOsiX5FF+Ucv+U6
TLSH
T181121A36F8786C3B4DD2A551B08735139EA45267DB886F94D9FC2B2C06EF59C530B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2fed71665a084bbdc8fd3ca37f61ff324853fda32f8321538f3bdbd65fcbb745
MD5 ef69f3f7e76050678e94316b233d356f
SHA1 4d359f6277a401500a242fb7cc59f7a103bdb3cf
SHA512 aa5a6a2af3ea78503cf9f47ed1c0a3a8f91a31a07a3d2f9fe09de50060d15c9aefdf39c691a7f67938c5b5d2039c26933ef14ed9cbb066cec6a6877ee4c58e09
SSDEEP 192:LONm6AmwprQmiUyCm6siX5FSY+U9JiRTaU6:LONm6ipdc6siX5FF+UqIU6
TLSH
T1F5020B35BC786C7B8EF2AE15B58B3B239F99112BEA941F84D9F81B1C01D764C1346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9928166d4306cadccde65b2a492597d57a5b019304ec66a223c8388b92593023
MD5 91c0b777dd623e9f85e72840db812b48
SHA1 22fd3885428bae218ae258cd0ae6f875440eaa73
SHA512 38d836896b9656087836d3c60f35554920d2121505d338d4a1ea1647ba2b2a41a3e5ed2e53666410ad7e6a36a6dd5b9fe1c7ed31caad38533d14694a6a8a9a8d
SSDEEP 384:eZcIhsNXIpE3Epu6EfW9iX5FF+Ucc+sa+VY4hG1oq:chA3EkCaZBB+hglhit
TLSH
T17D828D72AD786C7B88E2E292F54739039EB89167D7C86E84C5FC9B1D01DE5981307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b07fd9a7e3af20588489737631d4d60c2a912e2f8a8e8f0fdd4e1c7363e59387
MD5 bfd7fe9ef373d9fc35bd4edb2371a819
SHA1 a4bbe9716f2783a90dcbddec6b9a7b74c67c5bbc
SHA512 9fdcecd09b2940b66b563166b17d73d85965ccbeb1f44852226dea82f92bcfcdf4e63c38dfc70b96581194af705f36dbd44c12cc26c93b7964fb166240f2783b
TLSH
T126E00202570102FAC41C073840C3272067D3C47112E1036B591402647E533201E35E41
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a07e1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a07e1.TMP
Size 392B
SHA256 f231d5b6851b50bd1ba88b816cdccb21b754ba0fb50fbdfb80b277bb88659610
MD5 65de2d71d882069282abc06030a892cc
SHA1 971a1848034a696e7c23ca7222ce0b68cfb96e64
SHA512 76794e855d05d6d64493c099e2b0124a91616443d930f42b366aec1c918bc743a106392188c057c6e734ebfdcc5aa5a6ce445e00b8445c1b51d262da8c6f127d
TLSH
T13DE00403170101F4C40C073C4043170057C3C47110F0034F5D1401447D533301D35F01
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4316725d41e50645200dc8feac01607c5a01d57f9669bdb4652b85bc498190f1
MD5 13ba352fbed8579797d685c586d51ca6
SHA1 a7f80e5ed21d51096dbd3be8966ec4bafddb39e8
SHA512 b21ea58322ebb17782191ab4316452be75a3a5b664971f936cc2fa5b6f59a4c9633d55fabb5190491073809fc9f230b04851ad9e93c93eef39242dd499729b77
TLSH
T19E415B98A6F91118B3B72E4AAFF7A86D487BBD772E06C59D00110E4F4636A40CC71733
MD5 SHA1 SHA512 TLSH

Submit Download