hxxps://drive[.]usercontent[.]google[.]com/open?id=1yVii8fQa3Z_ZBY-kE70GxmKxxL1SG83z&authuser=0

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://drive.usercontent.google.com/open?id=1yVii8fQa3Z_ZBY-kE70GxmKxxL1SG83z&authuser=0
Sample260708-bme7qsg131

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1764	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279469479034140"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{9A404EF3-F941-4058-A94F-3D4CC6E8A76A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3452	msedge.exe
3452	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 852	3984	msedge.exe	85
PID 3984 wrote to memory of 1764	3984	msedge.exe	86
PID 3984 wrote to memory of 4176	3984	msedge.exe	87
PID 3984 wrote to memory of 4176	3984	msedge.exe	87
PID 3984 wrote to memory of 4176	3984	msedge.exe	87
PID 3984 wrote to memory of 4764	3984	msedge.exe	88
PID 3984 wrote to memory of 4764	3984	msedge.exe	88
PID 3984 wrote to memory of 2000	3984	msedge.exe	90
PID 3984 wrote to memory of 2000	3984	msedge.exe	90
PID 3984 wrote to memory of 2000	3984	msedge.exe	90
PID 3984 wrote to memory of 4920	3984	msedge.exe	89
PID 3984 wrote to memory of 4920	3984	msedge.exe	89
PID 3984 wrote to memory of 4920	3984	msedge.exe	89
PID 3984 wrote to memory of 2392	3984	msedge.exe	92
PID 3984 wrote to memory of 2392	3984	msedge.exe	92
PID 3984 wrote to memory of 2392	3984	msedge.exe	92
PID 3984 wrote to memory of 1188	3984	msedge.exe	93
PID 3984 wrote to memory of 1188	3984	msedge.exe	93
PID 3984 wrote to memory of 1188	3984	msedge.exe	93
PID 3984 wrote to memory of 2416	3984	msedge.exe	95
PID 3984 wrote to memory of 2416	3984	msedge.exe	95
PID 3984 wrote to memory of 2416	3984	msedge.exe	95
PID 3984 wrote to memory of 5016	3984	msedge.exe	99
PID 3984 wrote to memory of 5016	3984	msedge.exe	99
PID 3984 wrote to memory of 2680	3984	msedge.exe	98
PID 3984 wrote to memory of 2680	3984	msedge.exe	98
PID 3984 wrote to memory of 2244	3984	msedge.exe	102
PID 3984 wrote to memory of 4832	3984	msedge.exe	114
PID 3984 wrote to memory of 3152	3984	msedge.exe	115
PID 3984 wrote to memory of 4492	3984	msedge.exe	116
PID 3984 wrote to memory of 3480	3984	msedge.exe	118
PID 3984 wrote to memory of 3480	3984	msedge.exe	118
PID 3984 wrote to memory of 3452	3984	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.usercontent.google.com/open?id=1yVii8fQa3Z_ZBY-kE70GxmKxxL1SG83z&authuser=0
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x218,0x23c,0x240,0x210,0x24c,0x7ffc32edc188,0x7ffc32edc194,0x7ffc32edc1a0
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,6484198074546143736,10177127457684068750,524288 --field-trial-handle=2036,i,17842917310777038952,16561078403146477654,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,16368743500361130543,14008525343304439649,262144 --field-trial-handle=2036,i,17842917310777038952,16561078403146477654,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,3218100101230783756,6530092599084357863,524288 --field-trial-handle=2036,i,17842917310777038952,16561078403146477654,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,12291036828483432405,14338238176477058886,2097152 --field-trial-handle=2036,i,17842917310777038952,16561078403146477654,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,11398681655215569599,18435612862508654325,2097152 --field-trial-handle=2036,i,17842917310777038952,16561078403146477654,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,13165356732836308591,6961704016852832044,2097152 --field-trial-handle=2036,i,17842917310777038952,16561078403146477654,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,18293044624371663749,3228882909801890634,2097152 --field-trial-handle=2036,i,17842917310777038952,16561078403146477654,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:2
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5012,i,4373701506341998551,3233058384124517639,2097152 --field-trial-handle=2036,i,17842917310777038952,16561078403146477654,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,4648214421464866548,2116194392980477255,524288 --field-trial-handle=2036,i,17842917310777038952,16561078403146477654,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,16605735735275370790,5627758530430444717,524288 --field-trial-handle=2036,i,17842917310777038952,16561078403146477654,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,11917005988097846808,13069460632001910522,524288 --field-trial-handle=2036,i,17842917310777038952,16561078403146477654,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,11917005988097846808,13069460632001910522,524288 --field-trial-handle=2036,i,17842917310777038952,16561078403146477654,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,11548309788393325740,11263812182894622835,524288 --field-trial-handle=2036,i,17842917310777038952,16561078403146477654,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,5985684971267645817,17209890665124530380,524288 --field-trial-handle=2036,i,17842917310777038952,16561078403146477654,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,17150082252759465328,7620728460388828384,524288 --field-trial-handle=2036,i,17842917310777038952,16561078403146477654,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,5428738258347798818,5238685215951283558,524288 --field-trial-handle=2036,i,17842917310777038952,16561078403146477654,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5768,i,10933389032516447554,10527076052756731931,262144 --field-trial-handle=2036,i,17842917310777038952,16561078403146477654,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f274c4f2bdc0d290027822aea21db53de03c6066bd36e863b4ff909ca3a66e46
MD5 3e03519c0c95746ef3dd5787ba3f8807
SHA1 2a88a13a1dbd566684d9a9831869b19264bf2844
SHA512 ae1ff05b418e37ba0861195c01f82c656027ac8abecbccb19009b00a90c77d70aa4bb502cd84102f65e89fa8ec223ef38c5c743f2f655a5f86e292ac5ed0f747
TLSH
T1C771637427018054D7670872CFC912EB76368AEAFCAB3E8511F2BD74A121F328667B1D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588fb8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588fb8.TMP
Size 3KB
SHA256 447b9d4881f3a6af1e691c0312c45294b63df9825d454b04bc32b4fc7daf96b8
MD5 e6c934389a46d746650546de6c39c46a
SHA1 0d1978c032a6eb18f071d36126521cc88dab0956
SHA512 6ffc464f10a084604553a34aa5d19d03da169fd739ad84b28a9d1230e3fc07d176c50f46c3526ecb943af6721a87e61808d7dfe35c61af31b5c6ff2d813d311b
TLSH
T13171417427018054D7670832CFD912EB76368AEAFCAB3E8511F2B974A121F328667B1C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d4802af93390a8f3421d54ce25ef1067c393f050ef99d75f4a573ec146be05d3
MD5 eb6b944be835f61d76460973fd625c3c
SHA1 02d22155b89d2fe18ac8b397fac3079951676a1b
SHA512 840918a039f041ed82783c92eef382f3f8fbfd096d3adbceca2dd236ce0d741898f46409d6f2ba10c1742e481a5c10bed9976120d72bbbb6150b5c3912b9b16c
TLSH
T133217BF7C3E5856EC91156F0AA14BE2BCE2D0505431C3C1A89E4EF2BA3E2475E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 edd645299d9efdd8c4d8941db5e32a3114f3b95274521292ea304c20fac9721c
MD5 8212d2c57e40eae60d401185bf320ef1
SHA1 b38583375a5dc68a8041d86e07ac4b1dff9a1512
SHA512 9bb459a485085b11b0e60a9d7070e8502db2b87237710f19dd48f80dc5fd351cd7957439b3c09b5d4ee8d2dff3a35ee0758b7bc210c4dbe2ffa4bf0c1f40d1cc
SSDEEP 192:sxZqRgyM/jK1Ml8UQtku/fCsGKxIVUIdpXVmHW6+WNs9d/Yv0WKjg0Ig59J:sxZqyqGu/fCsGg60Hb4/zzdd
TLSH
T16652C7636A345977CCDBD20DFA51BB53E6F5546296900E48AAFCCA0C01E6EED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1513e47785566a89d9f0883e67b14e0414f24285ba58f70217282eca73173b15
MD5 f272e3f868a0bd1df0750ace06a1fd51
SHA1 535ef1ed30762748a7438bfb0244e9f04d3fd9d3
SHA512 c3b413d00d903cf97cf8c2a2d051f887cb4d96c53184e68ec954fba771e1b0007bef146a83d109c0a3ef5b9f43897fd4ea7cf0d48670d9ef76c27dac1ff28be4
SSDEEP 192:sxZqRgyM/jK1Ml8Mku/fCsmKaIVUIdpJVmHW6+WNs9d/Yvwnjg0IgrJ:sxZqyMu/fCsmj66Hb4/9d9
TLSH
T12452D7536A345977CCDBD20DFA51BB53D6F90462A2900E48AAFCCA0C05E6EEC2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f8f5b6494af086f7a2e403da9e11518e3ea4c52dcf5ab75bb3789b44e76f871c
MD5 5e678cdd2ae95d853d0764ad7a0fad13
SHA1 a387c3926b2f8a580aeb9f2007e6919dc02b2d28
SHA512 1b4e9bb8fdb618babc0be07e177784fbf3968b664005568c21fff9f3c3b3b8520a57b52deeb98ced02acff4e9447393d59eeb69f81d2a3e120465652b2d6baa6
SSDEEP 768:igseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppNrolh:igseJ3xWvhfynu1jaVcL88pmD
TLSH
T1EAD20B2B280CCB7E4F844E6DEC2A6F966EE801CB57984D5487EA880C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592c17.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592c17.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 9cb889732063aa5c30d116d440486d74eae73b1005b2c6671ba1d88b1502a99a
MD5 985e2fbc72b1e2dafe5a93cf03ed1bd6
SHA1 7728f5ec293d50f7f5479ff68c5597418f330930
SHA512 8a92236e94ba7b825b12edf261a98d547e9be40457ee7a5a757a2248e306eb2cc3bc7ecaba76497699863ca6d0e0afe1526f2f30da88b3d4faa3f99e25ff03c4
SSDEEP 384:QtNn/s3n9SfsNENJ7bQ/okdeKS0lETBd2U:Qj+9UTmz2TBd2U
TLSH
T1D9625B726C795C2B6DA3E286F50A37075FF8516B96C02F98EAED6F0C01DA66C0307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 a1b775fef669fc8006cb9d8152b50faed5194ecb3790bcb8e726871a81d5a694
MD5 153c32c544f2877d87a726cb277dd001
SHA1 b4fe59ad10475605732e755ae9bdc15374bf7767
SHA512 2b7956798d28874979c881a437af1b26764b1ea55c3330c38d8790b834feb44f3bcb64cf8c6b0245a652a0f143d2446c06d73c24f5f688224d5ed0b7fe5bae2e
SSDEEP 384:kiF1tNn/s3n9SdzsNM8TUNTUlIlYJ7bQ/okdeKS0l6TBd2U:/F1j+9CRwgQmzUTBd2U
TLSH
T10E823A735C698D3BADA69B85F50A33079EF451ABDAC0AA94E7DC5F0C01DB2AC0307D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a1272f0a294d7d2d2e30c4e529cf4294dffd3bb2dca10c7462e13d0c9cd5b241
MD5 6ed994843514166b9a469c4c801e8bc7
SHA1 5234b630637971bd48094ad1d65aa4422cbc907f
SHA512 14c695b18681dc1865b5da382b8153f4bb083a0f95c5e13476ede435ca39b0414d1460aebe7db094588851e7d40e41b4b452f6283d5fd0fcfa465b91969af9db
SSDEEP 192:lONQ6vMtPQmiUyy3ThTQj+FdLKKSh847TGWU/u:lONQ6UtRBTbdeKSJTtU/u
TLSH
T11102F836AC785C7BAAB3AD46F48A27171FE4216FA5911B54EAE82F1C00D765C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 df26a403322c9508fd403973021ec55309a809c9ea62d7aec8791f0416cbd1d1
MD5 673d2b16b74e11a519ecd2e52122e61b
SHA1 5d3841e0d07c96a9236f0a49d7fbf11ceb3a3a06
SHA512 f06d0ed184d87a13c578dc8b54570f7a92a04f4baf2f5a8820fbd35ab407e47ba624242d8d1b4a08c5f6037fd512a02f61675a0b951d39538979dc2892b30227
SSDEEP 384:itNn/s3n9SfsNEYJ7bQ/okdeKS0lETBd2U:ij+9Uimz2TBd2U
TLSH
T1AF625B726C795C2B6DE3E286F50A37075EF8516B96C02F98EAEC6F0D01DA66C0307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 801527770f9ca0175b406198049ea3df7cca14eb73ff7997ee217d2bb1f53a49
MD5 4ba8d11fa0466547b46189d0c74165e0
SHA1 76814771e94da294f03223314ab219295e58741d
SHA512 95b98b2d0df894f8830a6cb3feefc7375c434b4e83aa2b744bc204122e5abc38c6ad8e1419b6f29e22aebd7f78e663a2a1357a04fceaa9999ce7f1b8963f9b75
SSDEEP 192:IONF6vMJPQmiUyT3YhTQj+FdLKKSnGNl680ITfqcdU/u:IONF6UJRuYbdeKS0ljTBdU/u
TLSH
T145122C73ACB95C2B6D93F182F48A36075EE4916BEAC46B54FADC2F0C01EE65C1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b6f2adc-1fa9-43b3-8161-9745ea17d488.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7b6f2adc-1fa9-43b3-8161-9745ea17d488.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6cb66bf20bd038ea8771082c4e35d74279c3da3f1e8a401f17efde664d3c2d52
MD5 d1529d00bb37dcc742849600e6d1cb22
SHA1 3c4ca09914513c0ed0ec39ac2c411677aa74d3b4
SHA512 c13269608bd53e931efbd7c993497ed057614cf17052003a11190ef5d4af3f006c88e4f1f4888d03876bd19bb7b2fef847a651ee59f1efc0a4a0b7b64e11e0ce
TLSH
T159410B5D7AF91144B3B76F169BF6A46D447B7C772E06C59D10010D4F0623A40C9B2B37
MD5 SHA1 SHA512 TLSH

Submit Download