hxxps://drive[.]google[.]com/drive/folders/1d94tQW6oXJErbyElzbAxebBI0WC2ZheO

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://drive.google.com/drive/folders/1d94tQW6oXJErbyElzbAxebBI0WC2ZheO
Sample260804-wpvqesbm2s

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	drive.google.com
4	drive.google.com
14	drive.google.com
20	drive.google.com
49	drive.google.com
85	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1228	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303403880297546"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{A262276F-6827-4C7E-BAE5-48AAAA2B1C02}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 4368	2016	msedge.exe	86
PID 2016 wrote to memory of 1228	2016	msedge.exe	87
PID 2016 wrote to memory of 2384	2016	msedge.exe	88
PID 2016 wrote to memory of 2384	2016	msedge.exe	88
PID 2016 wrote to memory of 2384	2016	msedge.exe	88
PID 2016 wrote to memory of 3540	2016	msedge.exe	89
PID 2016 wrote to memory of 3540	2016	msedge.exe	89
PID 2016 wrote to memory of 4568	2016	msedge.exe	91
PID 2016 wrote to memory of 4568	2016	msedge.exe	91
PID 2016 wrote to memory of 4568	2016	msedge.exe	91
PID 2016 wrote to memory of 5104	2016	msedge.exe	92
PID 2016 wrote to memory of 5104	2016	msedge.exe	92
PID 2016 wrote to memory of 5104	2016	msedge.exe	92
PID 2016 wrote to memory of 2404	2016	msedge.exe	93
PID 2016 wrote to memory of 2404	2016	msedge.exe	93
PID 2016 wrote to memory of 2404	2016	msedge.exe	93
PID 2016 wrote to memory of 1500	2016	msedge.exe	94
PID 2016 wrote to memory of 1500	2016	msedge.exe	94
PID 2016 wrote to memory of 1500	2016	msedge.exe	94
PID 2016 wrote to memory of 984	2016	msedge.exe	97
PID 2016 wrote to memory of 984	2016	msedge.exe	97
PID 2016 wrote to memory of 984	2016	msedge.exe	97
PID 2016 wrote to memory of 468	2016	msedge.exe	99
PID 2016 wrote to memory of 468	2016	msedge.exe	99
PID 2016 wrote to memory of 3092	2016	msedge.exe	100
PID 2016 wrote to memory of 3092	2016	msedge.exe	100
PID 2016 wrote to memory of 452	2016	msedge.exe	103
PID 2016 wrote to memory of 3780	2016	msedge.exe	108
PID 2016 wrote to memory of 3968	2016	msedge.exe	109
PID 2016 wrote to memory of 2504	2016	msedge.exe	110
PID 2016 wrote to memory of 3788	2016	msedge.exe	118
PID 2016 wrote to memory of 3788	2016	msedge.exe	118
PID 2016 wrote to memory of 3152	2016	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/drive/folders/1d94tQW6oXJErbyElzbAxebBI0WC2ZheO
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b8,0x7ffe3bf5c188,0x7ffe3bf5c194,0x7ffe3bf5c1a0
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,16326694559340676905,15699496542372081698,524288 --field-trial-handle=2292,i,14337009391770840950,1683444621380324909,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,755389683216289516,13646440589726623339,262144 --field-trial-handle=2292,i,14337009391770840950,1683444621380324909,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,17059804661576946130,14399192853289975400,524288 --field-trial-handle=2292,i,14337009391770840950,1683444621380324909,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,6265752094704909202,525879570455485176,2097152 --field-trial-handle=2292,i,14337009391770840950,1683444621380324909,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,5905948834589541482,2001459673035018868,2097152 --field-trial-handle=2292,i,14337009391770840950,1683444621380324909,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,18193388103393267058,2106395428471635805,2097152 --field-trial-handle=2292,i,14337009391770840950,1683444621380324909,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,3963355216845447788,5198958858593988091,2097152 --field-trial-handle=2292,i,14337009391770840950,1683444621380324909,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5084,i,16558660604220322921,10519960232459619841,2097152 --field-trial-handle=2292,i,14337009391770840950,1683444621380324909,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3416,i,199747855849585811,2940777119988456257,524288 --field-trial-handle=2292,i,14337009391770840950,1683444621380324909,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,8929129465852605287,12552951010936301648,524288 --field-trial-handle=2292,i,14337009391770840950,1683444621380324909,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,15883141006703995446,10131451627701117345,524288 --field-trial-handle=2292,i,14337009391770840950,1683444621380324909,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,15883141006703995446,10131451627701117345,524288 --field-trial-handle=2292,i,14337009391770840950,1683444621380324909,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,14287448412137176338,17974851730046618938,524288 --field-trial-handle=2292,i,14337009391770840950,1683444621380324909,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,16590147762359152992,15964142642295333879,524288 --field-trial-handle=2292,i,14337009391770840950,1683444621380324909,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,11477354061270536414,3837348279237261724,524288 --field-trial-handle=2292,i,14337009391770840950,1683444621380324909,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,7532961109314106723,7046063428013874884,524288 --field-trial-handle=2292,i,14337009391770840950,1683444621380324909,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6220,i,8131943483208358186,12023915094271813074,262144 --field-trial-handle=2292,i,14337009391770840950,1683444621380324909,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 92a908538089a45b7267542a2b86d1a63b5a35a14b876e2973f8c13aad1654fe
MD5 3be5a24efaf87f3baed7f1fe7380e63b
SHA1 bbf3f915abb0c0973886257d8d70206849d13325
SHA512 46f6a5196f27bc42271724c4ec93c2d258ff71f175073a3d6d7f098db60666d7acceae87b6c053d4ce205a6d1ca3e790261390f9a01bf8af4376a0e26832e3fd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7l:fwUQC5VwBIiElEd2K57P7l
TLSH
T11AB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 f68b6431327220c6cd4a3e865252706c22d19eaca6383e9ab5bcecf7fdf368e3
MD5 da3e6172ddf39e5e31e28a41721e24b3
SHA1 755b98a9a639d7789a5b92e341a4ae02e648c12a
SHA512 40ff80062ad1619fdb9e6ab663d6c4757c666d0f17e30c289dbd9327a4f8f8015451d886cde3b141eb01ed26813ab294749a80c963c2e208ee0432d3eade0da5
SSDEEP 48:1HYmQJsl2y8q94O0lzXmQce1tpUx9zT8YBF8N09p4mfbIwWKa4KfTi:1HYel78A4OcTXZJ89X8AqN0r4JSaVfTi
TLSH
T19581E6326635009CD3604271A8ED61067DF485E8FD375F16A5CC7ABB6E0EFE4A39AC48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 95b24fcdb7787fa0458de4b59672d1a646c7612290c57ddb13a716d584945ff1
MD5 ee9d98ac8f100ac635ca362ac2d766b0
SHA1 99d39452613edf28e45cb5b514f5fd83b551b96d
SHA512 70849bbde3faad3039e39900ca0692ea66c60a5d484f4c90fced7d8b1a7fd3b5fba2b835d966cf08044caa74445b41b14f72fc9ac2168faf3a8966829a4622c6
SSDEEP 48:OHYmQJsl2y8q94O0lzXmQce1tpUx9zT8YBF8N09p4mfbIwWKa4Kf0h:OHYel78A4OcTXZJ89X8AqN0r4JSaVf0h
TLSH
T1E18108326635009CD3604270A4ED61067DF481E8FD375F56A5CC7ABB6E0EFE4A39AC08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58cd7c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58cd7c.TMP
Size 3KB
SHA256 4efc11e84a211ea3cf55f12b99a889c4ce3d6386c5178b8d06967736869c4b87
MD5 7826d4dc95930c546fa7cc112bf56a9c
SHA1 c33d996cb69317408fb2bf26da256b239102e963
SHA512 a53ea958222f52fbd468e974c0e09032b307274cfc14e7aedf856cdc392316057c8a2c026600b69b26165c799380ebbc440ec66afc5d67f918b10b45216789b0
TLSH
T18671B734013500ACD36041B1A4ED65457DF481E8FD375F02A1CC79B76E0EFE4A769C49
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 07e49a9469740509444513fb32f296442c0a4966f0cb4b426124eff308c4702e
MD5 cbcaa2f70572eb1b5b2cd8974912d46d
SHA1 6f190e3e4894ba01a89d3eff3e14b29c8f77ff1f
SHA512 a31f7fc640b05eb3c4fd142201b0820a6edf1014a428b312165191682b0bc9396835e92fef177ae09c07ea8f808e1287824d698b69b5e529c783bd31cbbb93b0
SSDEEP 96:D+OPFCLWCyeffz4FR0HxcNPKuCuWmwLs9:DtPFCLWCyeffcFRixcNPKuCuWmis9
TLSH
T126C18AF7C7D9822DC90156F49715AF2FCE2D0A18431C3C3788D8AE9BA3E2471E21565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6305ec816ed8fc65ea7562d81f8e871dc0c29453b6e38d21d9425e839520e289
MD5 4723f8bc816863b018f5e3ba2d587f85
SHA1 5d2e6ca2ae3a5efe170d26dea43d96870d7e3070
SHA512 19ce25fa743411dd51dbaa184310b4403b861960979cafcfa509b0460252acfef7cc0f83969ee6b04875f4fa1be736671a8d70c26be19e54c44df45f0d6da3a0
SSDEEP 192:sxZXRiyM/jK1Ml8Mk2/fhsA67ZNcjnIdp3C9DHW6+WNy2l/YzGCZlkIgrJ:sxZXsM2/fhsJ7ZNc0qDHbx/sq9
TLSH
T16452E816BA349977CCCBD609FA45BF53D6F5147292910E58A9FCDA1C00E6BEC220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7e378a63c2b31a92ff7ad24a500e17f4154e0e56aa878c7bbf59a53cb405890b
MD5 b9135cde3d1f34c2ea766b00f9f59228
SHA1 17c7943283c8d477925888d1f6ba6c8da9fd0190
SHA512 e7c3576a151aebb69c281d78a77313b70b224a3ef08061f7ee24c936de8c625c033eaa2997a8b9ed797335f48c19ff222af73b3c5be0d6fec40b2176836c6a5d
SSDEEP 192:sxZXRiyM/jK1Ml8UQjk2/fhsg67ZKcjnIdpVC9DHW6+WNyKIZYztRZlkIg5qJ:sxZXsqI2/fhsp7ZKc08DHb0ZgqE
TLSH
T12352E852BA349977CCCBD219FA45BF53DAF5147292910E58A9FCDA1C00E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 268f4dda13c5c47acd7c00a949fb203cf0295345d943e4935c22cfa097de9fba
MD5 491123da9a3347e7d4fcc50e676b95ad
SHA1 3a11d221673db7275e846fe7fdc1bc646c7b0c58
SHA512 ad3b7cb680c8b86d730cf10c2d978d85e92a5ce7cf20a947f8933777db5975b8be6856e3331d430f1910786277a93e3d86e992cb594c6709faad8b10ac89729f
SSDEEP 768:hoW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjWroIliRYz:hoW7kf0Wvqidau1jaa5LA3jtMz
TLSH
T179D20B3B680CCB7E4F841E5CEC266F966ED801CB66988D5487FA884C03CB7EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fd0989e1bdde893e84faea1ba63e8970399473dbd9975db66622c7caca74e935
MD5 3999510d5de06139be2eda46427735be
SHA1 d40a1f2cb64607001f516825c32637fb4760084c
SHA512 50fff2c286844e5d442d15f39074b1c0f86471b71723fa0f8104642946087ba8fe116e3615eeb9340b0cc188f3c74e09e2e3ded13029603ac857a9d0d1e90846
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTT4IHKVG8jyJCIfKLagz2I3KXK4PyD:KIbCKcT4wKVGKaCMKLac28KXKSg
TLSH
T115A16611723B0A413CBE3C0C92A98E779E9235633819646F7BB951664D6BE112DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ce9fa52-7b9a-462c-a753-1165bee272d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7ce9fa52-7b9a-462c-a753-1165bee272d8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 bf2775d0aa08d93639d79a0148df9a070d3c5714ff49cdb552ca0236ecb08313
MD5 397328048adb7d45c205fb9c0747ac1c
SHA1 f9cd5c6f431dd97ca03aaac21acf76925dd8fc00
SHA512 fdbcd50211908d9a99ed531e6bf8ac02fccae20f7b47bf059fa6069a5b84304617eb60ccd0ca840502e0b9b9e5d8a8c260168fd9ed347560c970abb4afaff013
SSDEEP 384:bZcIhsN60X0/50bUS2urdV5+26jBeRs9JKgqijUSR:DhFWj3Vl6jTjKgqmUSR
TLSH
T11E929F355C395D3B9AA2B582F4863A178FF89027E7C46F64F1ECFB0D0199A9C130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 63ab7d13efa32490e1e6c4e60fb17d919dc8acccc08240350cf9576dd80d8125
MD5 0ae807e613e6192b6db413e641fc3aae
SHA1 f20cd509e2d7910c5ba95e5b6cd811ef60143f22
SHA512 eccaa5e95171470860947c76e84fd38b3d872004f7373a33ee4c93c891b1d2eaa7a25000bc7b23c32307510bf5fcbb09162962b565ac362c2ab07708a0b99abb
SSDEEP 384:7iFiZcINzsN688TUNTUlIlq0/50bUV2urdV5+2NjBeRs9JKgqijUSR:WFQ1SwgzWg3VlNjTjKgqmUSR
TLSH
T18FD24BF648D7853ADAAD5B43E77D2E038EBCC027B5806A54B3D89A0CCC565BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7c23269701a6fe3ddbc5e4f7f6ad48e81e6ab1a48e4f763d03d48a5d27fa7b82
MD5 0aca5caac58de80756f5475a5a8b5cf1
SHA1 751d3d7cc2db2fdefd4cd539e1f9c39797abc17f
SHA512 dcecb638b96504cd1bd39e506745ae7bf4a4db9c78cda2c0f8b92f0b512901c69b33d5ce54e40a75b774b85b8f951635bb606f43881c6f96cb11895c9fa72f2e
SSDEEP 192:MONM64BAQmiUye1hW5GBPKUq+FdGe5A0aDtxU6:MONM6eARDWUdVsrU6
TLSH
T1EE02FA396C796C7B9EB2AE45F58637175FD8103BEA841B44EAE85B0C00D768C2303817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a6f22161587f3c5856d02ead24602a39eca263581df03bff67f075b8e9e49b7a
MD5 7281bf7d10c434bb4e9a7bce1b1492e6
SHA1 10aca83495e3991caf445500495e9906bcd9a097
SHA512 21c414d11582a71d41b10266eae6c7cb34170ea84829624b3bf367cf808b10fd3aa99216989df5fff6057be8d9dbd4eabccf1670b193cc1599079c2628a33bcd
SSDEEP 384:0ZcIhsN60q0/50bUS2urdV5+26jBeRs9JKgqijUSR:yhSWj3Vl6jTjKgqmUSR
TLSH
T13292AF355C355D3B9AA2B582F4863A178FF89027E7C46F64F1ECFB0D0199A9C130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8adebb31fe513ca842db009acee84e593e587812061973c8d269da40721a00c8
MD5 50aab38969effbff612f5e6070c990ff
SHA1 2960715453caa0a9652735b06d6d5ed4a5535b5c
SHA512 5a2f31a1be6e88ed7960bcf7f8b98098f1f70667c1c9e23da3fdabc3e10131bb8e93dd4f3fbd5b4eec73b96169957e24416a6130898191f8bb9b11d907e73a4a
SSDEEP 192:6ONOB64BaQmiUyghp5GBPKUq+FdGe5AMV+22WwhqWU6:6ONOB6eWvpUdV5+2UjU6
TLSH
T12A122C3AAC746C2B5EA1A551F08736039FA94137FBC56B54F6EC6B1C01DF7AC2306416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1547380d01c2aa981af36d4e693f145a3e44e2b0c3b30d5f6e8cf0020aebc273
MD5 f907290425e044a8504565fab64d5468
SHA1 eacf81ba000cce4b7374ce28af5fc56a8b375553
SHA512 9c553ba2e3f6c9445d2e8dd902059fb38fd84cb8fb2f44de2458a671ebe000e70898735ee57fd63c301aad2c0f54c3673b84fb49c769489d7b63ae6db0c81b3c
TLSH
T1FB41C768BAF91158B3B77F1A5BF6A9AD447F78372E07D59E00110D4E0A62B40CC61737
MD5 SHA1 SHA512 TLSH

Submit Download