hxxps://drive[.]google[.]com/drive/folders/1odd83epIvbuJTNbG06c2Qs_2NdMrL0fa

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 21:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://drive.google.com/drive/folders/1odd83epIvbuJTNbG06c2Qs_2NdMrL0fa
Sample260712-1fdg1aa17v

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com
2	drive.google.com
12	drive.google.com
13	drive.google.com
21	drive.google.com
23	drive.google.com
45	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4264	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283657371806150"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{3E421822-AD1E-4D41-850B-8B7C0EC33027}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2376	msedge.exe
2376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5764 wrote to memory of 4812	5764	msedge.exe	89
PID 5764 wrote to memory of 4264	5764	msedge.exe	90
PID 5764 wrote to memory of 5840	5764	msedge.exe	91
PID 5764 wrote to memory of 5840	5764	msedge.exe	91
PID 5764 wrote to memory of 5840	5764	msedge.exe	91
PID 5764 wrote to memory of 4104	5764	msedge.exe	92
PID 5764 wrote to memory of 4104	5764	msedge.exe	92
PID 5764 wrote to memory of 3388	5764	msedge.exe	93
PID 5764 wrote to memory of 4924	5764	msedge.exe	94
PID 5764 wrote to memory of 3388	5764	msedge.exe	93
PID 5764 wrote to memory of 3388	5764	msedge.exe	93
PID 5764 wrote to memory of 4924	5764	msedge.exe	94
PID 5764 wrote to memory of 4924	5764	msedge.exe	94
PID 5764 wrote to memory of 948	5764	msedge.exe	96
PID 5764 wrote to memory of 4740	5764	msedge.exe	97
PID 5764 wrote to memory of 948	5764	msedge.exe	96
PID 5764 wrote to memory of 948	5764	msedge.exe	96
PID 5764 wrote to memory of 4740	5764	msedge.exe	97
PID 5764 wrote to memory of 4740	5764	msedge.exe	97
PID 5764 wrote to memory of 3596	5764	msedge.exe	99
PID 5764 wrote to memory of 3596	5764	msedge.exe	99
PID 5764 wrote to memory of 3596	5764	msedge.exe	99
PID 5764 wrote to memory of 3184	5764	msedge.exe	101
PID 5764 wrote to memory of 4320	5764	msedge.exe	100
PID 5764 wrote to memory of 3184	5764	msedge.exe	101
PID 5764 wrote to memory of 4320	5764	msedge.exe	100
PID 5764 wrote to memory of 5816	5764	msedge.exe	103
PID 5764 wrote to memory of 2456	5764	msedge.exe	108
PID 5764 wrote to memory of 1368	5764	msedge.exe	109
PID 5764 wrote to memory of 5968	5764	msedge.exe	110
PID 5764 wrote to memory of 3600	5764	msedge.exe	111
PID 5764 wrote to memory of 3600	5764	msedge.exe	111
PID 5764 wrote to memory of 2376	5764	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/drive/folders/1odd83epIvbuJTNbG06c2Qs_2NdMrL0fa
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ff98c1ec188,0x7ff98c1ec194,0x7ff98c1ec1a0
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,9016561618408088291,13483175831120430401,524288 --field-trial-handle=2348,i,15196713229926135075,16875408252354421843,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,3654178103138914988,1841455106447399195,262144 --field-trial-handle=2348,i,15196713229926135075,16875408252354421843,262144 --variations-seed-version --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,11794817499448260736,10656789224085134744,524288 --field-trial-handle=2348,i,15196713229926135075,16875408252354421843,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:13
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,13571161200476136933,15096979445846378045,2097152 --field-trial-handle=2348,i,15196713229926135075,16875408252354421843,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,3112747000255415770,8505181826616536532,2097152 --field-trial-handle=2348,i,15196713229926135075,16875408252354421843,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,610084940926058985,10195326858683197272,2097152 --field-trial-handle=2348,i,15196713229926135075,16875408252354421843,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:9
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,1002303217089499350,13050667645073974121,2097152 --field-trial-handle=2348,i,15196713229926135075,16875408252354421843,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5528,i,15965759788076966221,52402530547435509,2097152 --field-trial-handle=2348,i,15196713229926135075,16875408252354421843,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,14650929587544790604,8595548833685203590,524288 --field-trial-handle=2348,i,15196713229926135075,16875408252354421843,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:14
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,14100776855419524133,691210282678834574,524288 --field-trial-handle=2348,i,15196713229926135075,16875408252354421843,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,14891884629732602994,14707286938927396526,524288 --field-trial-handle=2348,i,15196713229926135075,16875408252354421843,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,14891884629732602994,14707286938927396526,524288 --field-trial-handle=2348,i,15196713229926135075,16875408252354421843,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1680,i,16378295085591911433,16206886191436510576,524288 --field-trial-handle=2348,i,15196713229926135075,16875408252354421843,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,8929349485269507243,13791334480117019984,524288 --field-trial-handle=2348,i,15196713229926135075,16875408252354421843,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:14
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,9517351359411297810,3484736259046604383,524288 --field-trial-handle=2348,i,15196713229926135075,16875408252354421843,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:14
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,17644017698822201168,6844678573564973803,524288 --field-trial-handle=2348,i,15196713229926135075,16875408252354421843,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:14
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6212,i,13379473243956631689,2648484661858196455,262144 --field-trial-handle=2348,i,15196713229926135075,16875408252354421843,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 373KB
SHA256 a5c27d3298042314d98634f85836ab0c48cbdf572ee676981a852c3e18738d8e
MD5 7eb1501498252ec1a30118a2d3917c94
SHA1 b275a098ab3e050e2b4ac71eac10c238c2365c45
SHA512 8f5831b6bfeaea74aba0d23b684687e0a308f51f1528859535c9df335367b946b6be42500ce637e77baff40795bbf152e24abcfcee227c6d9d0e490412e09d26
SSDEEP 6144:bBJYkBiu4su2hIklCVm8ZiLHBd0R+2jBLX47rD+CNOgtU28xNAoWclJ/lo31jjuQ:bfWV22kvnBSw2FLIPDVNfN8nWclJ/Md9
TLSH
T100842306FA0DD6F4A7A40DDD2990A3E04D1372444CFC4A347B8523B9DDE3AEF4A159AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 1f3b7838da0e91e890af7f7418e5acf8714162e9dd14863a9931c12432289cb2
MD5 3281689bd241dc5c7a268e5f3cf2a831
SHA1 280cb3fc9704589444d1d909ade0398e1613c80c
SHA512 afaa73882c245bb4376896573dda07722336cd1e95a67f37a3d54ba475950042f6d66086d45695fe04cd7a026e0eff778c39ed648fa36de85ac2615e94faac97
SSDEEP 96:lzrAPIAoJKjjuhB6elfX78W6o8uH3kUkfq7PgkY2SWoc8XUzoB9Bq2zK5v7oJ8nu:drAPI3E/uhB6Yz8Wl8uH3kUK6PgkY2Bw
TLSH
T11FA1D06E4FB356D5F7554A7878AB9A7930F1E88E08076E1040E4AD789B47F2708E00EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a0e2a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a0e2a.TMP
Size 3KB
SHA256 7325863cd861f06d3962efd1c4576dc7a76eef4a2c686fb03527d6231e3c1cda
MD5 14ebaabe8773d6480e9f3f851e2f2219
SHA1 1fb82316ec346cd3ce293e637122fb558bf0306d
SHA512 b8a9a9ce037c52923938c2e87c40ccd419e2cae4750b56cd8295c23ebc14a88be66caeeb8901102501c1e11c1f6d950d05af689520fe8b7d1a3356b348b833c1
TLSH
T1C36195364BB2869AD7A6873A18EB9FB431F4F8464447AE0184645D3CCB07F2A5CE101B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 698023d4bd59f1f55957f3ed48f3f1ba425e3f0eb9ddd80f829bcc64e426563b
MD5 09edcb621365def3a474f5b0fa871621
SHA1 803adcf3c05058166c26671d387c1adfb9a68fd5
SHA512 cc7a95b08860f23ece48fc89f701d365fcaa28b872dac47403f981463a377a2d526a67a6f9b4e21e5d1cca7c8d4b5af60de877fa808d599766d0be3ab84a9d80
SSDEEP 192:D7ySNN2ZHKBqcgzXZEiDjhfz98kfFztsXeWygo+1lU9:D7ySNN2ZHKBqcgzXZEiD5z984FztsXe5
TLSH
T11102BEF7C7D8852DC80156F4AB15AF2ECE2D1A18432C3D66C8D4BE5BD3E2431E215A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 db521a6c7cb856b0f43e84f6d6450666c649e06664098b5b15946213323f97d2
MD5 1261968097a6667bf8201a409c7675ed
SHA1 1c6f43b71b6c2f42f3ce59bcebd62c3a0b723c79
SHA512 03950dfb85ab0a7786190033564feb0e150d76793313de20561a14df93fc90f313ad30c236c2cbc469dc1cb4c78ac23a824ef1b2c9c8501ce4e5f5e03a431efe
SSDEEP 192:sxRYRdyM/jK1Ml8wbX/fQsw1eKrjDBzoA8pQiY/g6+WNwFL/YEOiKbG/IgxJ:sxRY3lX/fQsYeT0/5q/Tl7
TLSH
T14B62EA0669245D77CCD7D20DFA51BF93D6F81523B2905E44AAFC8A1C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 88ba49aca2f8b61204f4e945c4c29039f90c3df8b1007a709dfc22cd4c2c565c
MD5 70c6117d9b3d543d2a82fc4b2c618080
SHA1 e7c7cf9dc9cb777f2732f9b7573862051bd893aa
SHA512 02fcb7365464b8ce516fe699834eb8ddf974030367b73b557d67d669e5aa6a3c470346409afc68a763a68ce741c866149748675f38ea7662adc2998488d413ab
SSDEEP 192:sxRPRdyM/jK1Ml8UQ7bX/fQsM1oKrjDBzoA8paiY/g6+WNwFL/YEuiKbG/IgDYJ:sxRP3qfX/fQsUoTq/5q/rlg
TLSH
T1EF62D91769249D77DCD7D21DFA51BF93D6F81523A2941E44AAFCCA0C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a5b3df7c1ca8d5c0e6646c5ccd2eea04c884411b4b9cfd0e2d0331faa1bed84c
MD5 1228c0173c53410b2a207b7c51c03f57
SHA1 0ce986a384e8fc9945755a1c366d6387623a28e0
SHA512 531ab9e700f97da0065235081ac5cec7d6c55a71c35a83a4a5a18828033c4e2e92c8674ee3b66de768883be27a39b3b912777704c63d20cd19d54f70d0e11b78
SSDEEP 192:sxRPRdyM/jK1Ml8wbX/fQsM1eKrjDBzoA8pQiY/g6+WNwFL/YEOiKbG/IgDOJ:sxRP3lX/fQsUeT0/5q/TlO
TLSH
T1C862D90669245D77DCDBD21DFA51BF93D6F81523B2905E44AAFC8A1C00E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 11798dd14c6b8c8c712c9e193b8cec914c6635cbc4e39f3137d87fd598d23487
MD5 5d6e2a251a5567d7ccd715749d6283ae
SHA1 a609aa2cc834718bf79fdb16c2e02739f74313cf
SHA512 96b3693ba660600c3b2bbdedc37870cbc14fe038007e8ead9c3bd60479d7f4661a953f2a5c1b3ac3005a86bcbf91e5056c9999f3ba31f86e33965feacdd866d3
SSDEEP 768:0hiiBaWgH7f3Q8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsOV8yroD6c:0hiiBaWgH7f3Qu1jaNI8pJ
TLSH
T1F8C21C3B240CC77E4F805EADEC2AAED66DD801CB9B984D5447EA894C03C77EB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 32401085e1177058f012cbb8f642aa3b38ac261f483f2296ed3743f55e706ad7
MD5 75eaeaddb94f03cb55ea5887d4472171
SHA1 ca1a3a6168e30c1a1133d4dc805bdf785579a14d
SHA512 fc52e9809f748cf19bdd0ccc60136b577ca105268ffa2e554e3080cb671e26f5e651299f10239229b29b05f8b3a80bdc6fcb8d28312d94835e81e708519fbd79
SSDEEP 768:mj+993kuEqGIHDaK48dHeByERRFzjK3YVcb9M8:1993kCGoT48dHSyw/Xcb+8
TLSH
T153F2BF71A8555E778CA7D28DB643379BFEF0422392C82E5895DDAB4E05C71EC430782E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 39bf363d6e8441ad3d86693294cb0f223b3640c31add5e9366bb51e3ead0b565
MD5 1f882ed7c1b23cdd2e094079e993c665
SHA1 a28795d9e254907753d85a19dbb70fa8100f28a3
SHA512 58509c213b72ea782bc538e27d7ffcdd22c425f1d4b56a590e5df9f3265c963650260a0b29a7a3bb1185a42c75a3737050d9993c3115fb3b118b82b00fb0fada
SSDEEP 768:Hrv+4UNbdT33uEqGaHDvK48dHeByERRFzjK3YVcb9MD:HbsbZ33CGOC48dHSyw/Xcb+D
TLSH
T1F413D071B8686E778DB7D289B1437657BFF0421382C81B68D5CDAB4E458B0EC430BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 182344f6f4a233e43062f8f38919ec0cec896311eedd378ab954e149f166e384
MD5 58ff08422a223492fbbf358456babe6f
SHA1 3b175b79a848bc273ad6151a8a847526c40f90e4
SHA512 54f8eab63dc6cd99e4728c08e4f1f4a00680d6eba2786da20d995e4c0554b3a2203c90ae58e32488eed62300aaba11c7c0da968c34ec39f114da176dbf012c1c
SSDEEP 768:0j+9933uEqGIHDaK48dHeByERRFzjK3YVcb9M8:j9933CGoT48dHSyw/Xcb+8
TLSH
T101F2BE71A8556E778CA7D28DB643379BEEF0422392C82E5895DDAB0E05C71EC430782E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 1ee7a57b5fa7fc07d69b92348e5c9f7a3fdd2fe60ef0b8fad589d849afba519f
MD5 d611a07f3fa4a60fb4f562970fb276fc
SHA1 192dd4a4da4542e2593f4c7f86a2d277e824b638
SHA512 a66ce822426534521b3a0b6b566b3bca1a01860f67c7ded8ee7f6f275db77177f0b6e3536e17157140a94f1ad9839099210136367416b053fb40fbc2a75582fb
SSDEEP 768:KF1j+9a3mwg7uEqGlHDuK48dHeByERRFzjK3YVcb9M8:P9a36CGVn48dHSyw/Xcb+8
TLSH
T156136BF158D74976CCAE874B777E2E56AEBCC163B1846954B3C8A90DCC860BFC306819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 224ec1aad6a042d0d07b1e6b4860b81eeac452cfae8caf678eecd7bc1200e001
MD5 3ecf470d0c74bd7e0e358626c7d294b9
SHA1 6a50967a8e1dcf11f4032b6aa7f6b5b706a69e42
SHA512 58dc67f183ab45337e95d8b3db27ed78e31e79f68f283fc82e8fae29d51d5586d0cc8c7ac0feefe17c024868b21aeab1ead8f03c903ec13ad682b96affb46176
SSDEEP 768:Qrv+4UNbdf3fqGK/DxK48dHeByERRFzjK3YPeVH1SCj:QbsbJ3SGS448dHSyw/pEH1Z
TLSH
T1D303BE31A8A85E774CE792897683B657BFF4411382C41BA4C4DD6F4E828B4DC130BE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

897bc416-37a6-40de-bd45-f0ab11166610.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\897bc416-37a6-40de-bd45-f0ab11166610.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download