hxxps://drive[.]google[.]com/file/d/1IfbQhrzD6XyxMPE7FdoGXrtya6-WpWYT/view?usp=sharing

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/09/2026, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://drive.google.com/file/d/1IfbQhrzD6XyxMPE7FdoGXrtya6-WpWYT/view?usp=sharing
Sample260902-we4wcazalg

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	drive.google.com
11	drive.google.com
19	drive.google.com
52	drive.google.com
117	drive.google.com
1	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4324	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134341462650607691"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{9D1762F9-978D-4C06-A686-EF0C6ED61D53}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 3604	3952	msedge.exe	85
PID 3952 wrote to memory of 408	3952	msedge.exe	86
PID 3952 wrote to memory of 4324	3952	msedge.exe	87
PID 3952 wrote to memory of 408	3952	msedge.exe	86
PID 3952 wrote to memory of 408	3952	msedge.exe	86
PID 3952 wrote to memory of 2884	3952	msedge.exe	88
PID 3952 wrote to memory of 2884	3952	msedge.exe	88
PID 3952 wrote to memory of 4880	3952	msedge.exe	89
PID 3952 wrote to memory of 4880	3952	msedge.exe	89
PID 3952 wrote to memory of 4880	3952	msedge.exe	89
PID 3952 wrote to memory of 3700	3952	msedge.exe	90
PID 3952 wrote to memory of 3700	3952	msedge.exe	90
PID 3952 wrote to memory of 3700	3952	msedge.exe	90
PID 3952 wrote to memory of 5040	3952	msedge.exe	92
PID 3952 wrote to memory of 1168	3952	msedge.exe	93
PID 3952 wrote to memory of 5040	3952	msedge.exe	92
PID 3952 wrote to memory of 5040	3952	msedge.exe	92
PID 3952 wrote to memory of 1168	3952	msedge.exe	93
PID 3952 wrote to memory of 1168	3952	msedge.exe	93
PID 3952 wrote to memory of 3460	3952	msedge.exe	98
PID 3952 wrote to memory of 2864	3952	msedge.exe	99
PID 3952 wrote to memory of 3460	3952	msedge.exe	98
PID 3952 wrote to memory of 2864	3952	msedge.exe	99
PID 3952 wrote to memory of 684	3952	msedge.exe	101
PID 3952 wrote to memory of 4940	3952	msedge.exe	107
PID 3952 wrote to memory of 224	3952	msedge.exe	108
PID 3952 wrote to memory of 4696	3952	msedge.exe	109
PID 3952 wrote to memory of 748	3952	msedge.exe	111
PID 3952 wrote to memory of 748	3952	msedge.exe	111
PID 3952 wrote to memory of 4880	3952	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1IfbQhrzD6XyxMPE7FdoGXrtya6-WpWYT/view?usp=sharing
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffc4c43c188,0x7ffc4c43c194,0x7ffc4c43c1a0
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,4228920101101482308,7568511710502345599,262144 --field-trial-handle=2088,i,11706274356054814363,14250219266772101422,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,8253038145584415755,2755662330738484436,524288 --field-trial-handle=2088,i,11706274356054814363,14250219266772101422,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,7202670941802863706,9217450455065828364,524288 --field-trial-handle=2088,i,11706274356054814363,14250219266772101422,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,4676346050386289452,2981494279517304183,2097152 --field-trial-handle=2088,i,11706274356054814363,14250219266772101422,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,15948818918299572619,13315197033724065701,2097152 --field-trial-handle=2088,i,11706274356054814363,14250219266772101422,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,8066372663085600414,5185698074974819192,2097152 --field-trial-handle=2088,i,11706274356054814363,14250219266772101422,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,2491208500471412573,10224145242568089377,2097152 --field-trial-handle=2088,i,11706274356054814363,14250219266772101422,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,10034223162398479259,13736242468337046782,524288 --field-trial-handle=2088,i,11706274356054814363,14250219266772101422,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,15764495224155650779,14160673068556942021,524288 --field-trial-handle=2088,i,11706274356054814363,14250219266772101422,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,17389170645041697270,7436528331324936507,524288 --field-trial-handle=2088,i,11706274356054814363,14250219266772101422,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,17389170645041697270,7436528331324936507,524288 --field-trial-handle=2088,i,11706274356054814363,14250219266772101422,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,10248502301121293573,17367165497597462386,524288 --field-trial-handle=2088,i,11706274356054814363,14250219266772101422,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,17789176866386708654,10120814494868709289,524288 --field-trial-handle=2088,i,11706274356054814363,14250219266772101422,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,15628846226385925985,3171059416566519036,524288 --field-trial-handle=2088,i,11706274356054814363,14250219266772101422,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,80598093020892991,18255352044878283058,524288 --field-trial-handle=2088,i,11706274356054814363,14250219266772101422,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6140,i,13140329128218963351,14403262698076431197,262144 --field-trial-handle=2088,i,11706274356054814363,14250219266772101422,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cdade49893be5531bcf3c7674bbe33add081fa96e8285e50018cdb047edbc390
MD5 f27b2bb2e82856cd11552f1da152dfdd
SHA1 ee53b389583366006c8a8ad178cae231bca55083
SHA512 73cc80da7ebb117279560f7ca04972bbe46bc3390206a3ae9bbc725d63f92d8b3bb2f0cb2741e2f39e6f56905f1ff5ade958ee8237f3834038b603096a57e1c9
TLSH
T1CA71FB45D186F651F7A4E53851C206F332372BA8F2831D8E0FD3C878299B750A2B30B2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596cf9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596cf9.TMP
Size 3KB
SHA256 c410f8ca40eecd2da02cb5aacd2de636eb9b9f7e1cfd8246f2356b575edff658
MD5 bb447256fbb79d4af4e984a7f04cc123
SHA1 31d96cea3aa0027bf42c5e954b74fa0402420a9f
SHA512 df46e295c3db2a87859239dfdc22ada89eef0eced905c9e0418e448df8867d145e03b6550cf32813fb3e9ceda08fcb6cabed4d58ea9996186880086e99596b34
TLSH
T1D951EB81E554FAA0FBA8C03886D616F732376BB1B1831D8E0FD7C8785857755A2B30B6
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 646431a0ca80c521495d6ebc1db816df84727c14509aee5665073984c266b65d
MD5 270276fc056ff630a5604f526c9b82d4
SHA1 37e7437776753bfeecad7baf21c0f2042977db57
SHA512 0d8407f8a5352f3ead35a441109a4bfa805c66bb5dd591bc30f30f721103001043f72fd798b0c086a000772c1999db3c824fa3717905bdd27cbf9dabcc401bf7
SSDEEP 192:DlUeDsvtGwExjiNJPHRlTVItNdid3VmZK+19:DqeDsvtGwExjiNJPHRlTVItNdid3VmZ7
TLSH
T1E1E16BF7C3D9822DC81156F89715AF1FCE1D0A14431D3D3A88D8BE6B93E2871E21969E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 9b45e5a7dee2fe6283d5ce0b234e8d11d50619bad745dce2d151042b3ee0c844
MD5 e172416f5866432a1e5bb2915c9f6b5c
SHA1 1678b3832170b8875a562a987438ab2e22635e18
SHA512 b0fcac4b9d647716ae7cf7e870e315e2c4c9dda421654d850dc09493956abec7a93bba8666b690cf47040f998b83acba390a52a5c8fa17587d5ceb5ccfe0e754
SSDEEP 192:sxZaR9WM/fZs8U07Idp7EHW6+WNywc/Y36lJiIgrJ:sxZa6M/fZs8U0kgHbm/XW9
TLSH
T1E522B8566E38A53B8CC7D20DBA29BF53E6F9503295D51E48AAFCC61C04E66DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 36154fb28cd6b0fefc4e3415f727e80e1744be6a6c1e97920ba9ac63b6258763
MD5 36b6362cf922455508872c449490748c
SHA1 878d2f582910a8d1853c9b8bcf69d567ff7bd383
SHA512 f5680544523e9b85653d4ca6f407eac68a275b7c0ac4a331a05c94cf6843107285a393ed579c1480585e724cb3e98172e9ccf80c6e2693d876de94de3dd0a613
SSDEEP 192:sxZaR9WM/fZssUw7IdppEHW6+WNywc/Y36yJiIg5sJ:sxZa6M/fZssUwkmHbm/X3+
TLSH
T16322B7566E38A97B8CC7E209BA29BF53E6F9503295D11E48A6FCC61C05E66CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 268567956241f75e15ccc3f9d7705687175122f7a468b3487c91bedd75c9763d
MD5 cebeff50cc02a70d521346f353144fc1
SHA1 8354cdfc4b5287af8ed33b0c1fbcf48b4da5eab3
SHA512 5a1445dbbac0538947fdc55ba1e2dc3c26f3f58f0dbb86ce18c2b3eceae26e45c55a9d27480f13e99847d00a79cf51a8f402a62ff958e3ebfcec2544c5a800c6
SSDEEP 192:sxZaR9WM/fZssUw7Idp7EHW6+WNywc/Y36PJiIg5sJ:sxZa6M/fZssUwkgHbm/Xc+
TLSH
T1E622C7566E38A97B8CC7E209BA29BF53E6F9503295D11E48A6FCC71C05E66CD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 454f890c5bd53177bec854b17541615706d449de79d677ba9bd4e1f3f92da632
MD5 7ce52243bdf0e144d631591f5f38055e
SHA1 b25d707ba7d4ff13c0502594d7c25c4601c71b35
SHA512 ff42bfdfb0989de01b33ee94e51554440c00074fe974bec8ceda2a93fa22be95188127cda4669145f4a9400c6318ec1b488e3588798841ec19028e519b89b4b5
SSDEEP 192:sxZaR9WM/fZssU07Idp7EHW6+WNywc/Y36lJiIg5GJ:sxZa6M/fZssU0kgHbm/XWU
TLSH
T14822B7566E38A97B8CC7D20ABA29FF53E6F9503295D11E48A6FCC61C04E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 788c3ea797be0fe7bec68b42a9bd1c5f5165ff54578e2a43e8cea341eb823a6d
MD5 4f0ecfb0fb25843798e476e89586500d
SHA1 070004661517bfa03824c6414d4a3107d79a6a1d
SHA512 4637dda42723a9683a4fa9c92bd865c25a12887346de80bc4b3b82803d8d8e07cb356e78532772ee25769a4b8f32a8b85a3e0babfb74371148585941e7e0237c
SSDEEP 768:BBKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/Wroya:BBKlm7QWvUYe0u1ja8/L/E/tya
TLSH
T1EAC2FA3B640CCB7E4FC05E9DDC5A6F976EA802C7A6588D4047FA984C02C77EA91264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f8d1cf77d35277b08f7e0b61ab0bf1a6a40ae7afec62b67074612dbc4e8bedb8
MD5 ccc3e15f872e485c2bd5b7c9596f55b1
SHA1 f0e0687fb6d593f9576be8012fa219f53fc1b08d
SHA512 9216763c8a82fd6a8d8410ef06d41762df532a35c8eff7143a2a1986acc27b0f0fac3a692fbd95eb0b88b752f2272695a07f347daf65f4a81e1ef1ea6ac0dfd0
SSDEEP 48:K0Py7PxRxKbJE5ISfKK9/11KxvaY89/jyL8rKWkmKzb6ZCISOzK9q1IzxsjYhyKN:KEYQKhmOej+KE42WLWKQUjz
TLSH
T1AF91AD5431BF124578BE29489078971A124231B3309CFA7BFBBC11968EAEE045DFF9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c4e856ba-973a-48f4-8426-dea010feef30.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c4e856ba-973a-48f4-8426-dea010feef30.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a9a45ddd33edfc07af64dd5c1b86d7606884817201ceb8ccd4c8249d67f66e41
MD5 7312a388e136e6538cd9fdd19fc2773d
SHA1 e4e588ea911defed89e97a4f541793f15e922388
SHA512 a8b4f28b483647191fe4c8d97f516656b66bdf0e51c1e7c904435ad30caab9cea0768dd2797b428487483ca73142de02aa914d82eaae0a96d193e2e64bb5c5e9
SSDEEP 384:iiFZ3yFaeO8uTsNs8TUNTUlIlE5bC7oh//cp+7MyP62l:pFZ3Izhy5wg30/Z7MyCA
TLSH
T10DC217F658D7983AD99E5B83A77E3D139E7CC0A7B9815A50B3C95A1DCC860BFC306801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c7e603d0fe4e119beeb1aa68da3b7a9da80e8adbbce1e625d9f25fbe9d6b07ae
MD5 52990454870dc6e69c6461147d75161d
SHA1 9a4b6fc3baa5be422b9d13d547d2e32959406f2a
SHA512 8597b994d52078c29492664ba9978fc2e39ee51158dafacdd1fa4dbed233762b26bdc79498b393bb259851ec97c85fc481bb632c0fc4a43bb6752d24c20be278
SSDEEP 96:KqONkoQsjpfbUmjH5ih/cIPURHl8h4otop5YaDV+BKP4v+Y1xf//ojdFxjYpoR1/:BONw6JUm0QmiUyRgso//ORhaBC6aU6
TLSH
T10502D739BC68BC7B8EE39E45F4877B239FA4107B9A915F80DAD86E2D01D715C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 cfea83c40a037609cbd74a2f8eed98badcf0903efa3d44e57e5502601f09a254
MD5 36094d566c5331da526b556bd1aae587
SHA1 f88a32dc21f5c31cbfae115830b1950f018abdb4
SHA512 6344510b3342a8fb2a081b2ead99cdcd97b7389f6a85a9718dea20e9e7bc87bba5ca1eb0cf6155ee7821743e9393c8b02acc8a672e74e0400cc565100835efc8
SSDEEP 192:u1bsNktQS6UbbzQmiU1Rl34h//ORhpoaoS/gnMwhP63m:esNkt5bhVoh//cpy7MyP62
TLSH
T113625B3AA8B8BC3B9DA39481F44735235FB440ABCBC54F94C6DDAF1E01DA1EC5302916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 39f25e3420da4ab68c3176315dd53fb42c61f891c34cd4d04b474e0ffc9a5650
MD5 2d508910fb07079a11885bf73f16afa8
SHA1 711756be6b27d233d1964ee2eaecb6e479162372
SHA512 0706427ab8c60aa955f6a56fbabbac51c5907cbc85cea69ce53653fe247f08131a08c903e19f1ddb5f7e477b4d335befa93f0733406259ef504950d8ef644dc8
SSDEEP 192:uvX3yFaAvzR8v/P83hUsNkEQS6UbbSQmiU1Rl34h//ORhpoaoS/gnMwhP63zRgl:I3yFaeO8KsNkE5bCVoh//cpy7MyP62l
TLSH
T1FF827C76B8B8AC7B9D92A481F4477513AFB440ABCBC65F94C2EEAF1E05C90DC5307902
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ace7290e00c472447b627216f235194398f4c889ad25d4767263cf04cb8e09d1
MD5 349d9ca07855e513ecbeec163191f063
SHA1 7c268ff3e04226e4ff5f3bfe1698434bbf32570e
SHA512 8f5537f1cb1bfc009c816d717e5d356c795c84d3e5f5210f626839ff19fb1d977d4d634b9388aa58e868b43770d21989b91b7b547b5f9eee29c356565f294258
SSDEEP 96:KqONkxQsjpfbUdH5ih/cIPURHl8h4otop5YnDV+Bt8P4v+Y1xf//ojdFxjYpoR1o:BONl6JUGQmiUyqgtGo//ORhpmNxS/gU6
TLSH
T136120935B8A8BC7B5D93A841F08376139E64407BDBC65F91D6DC2F2C02DA1AC570B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8c671b79ea14abf3342d5edbe71ebf3eff600656ffa2bbf54147ea45c4574971
MD5 4205ddc5e09afbe022d6a16bfbb161aa
SHA1 95267ec1f4d14128e0e819b494d1de0bf53f7722
SHA512 d869553e281f99e42df0d1a259817d51bae3ff4f539aad8505299d6119e623c0e720d968c44ef5da6496db7083932cc6cb52c476325d41bc63c1e060a7822839
SSDEEP 192:u1X3yFaAvzR8v/P83hUsNk5QS6UbbSQmiU1Rl34h//ORhpoaoS/gnMwhP63zRgl:y3yFaeO8KsNk55bCVoh//cpy7MyP62l
TLSH
T169827D76B8B8AC7B9D92A481F4473513AF7440ABCBC65F94C2EEAF1E05C90DC5307906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6257f79-b860-4a07-98a7-4585bcbfb8ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f6257f79-b860-4a07-98a7-4585bcbfb8ac.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6781ca4f44ff13fded2bc5577ccb2acc9e7ab42d766f327472d4f4a73671d78c
MD5 b37f0fbd4029257447329014bdc30296
SHA1 6a19be2b33e1e3042fd942e2ce4e137d7712144c
SHA512 1f326ef4fd1f6703cafda691d7e7338441a3b1d3744b2d2a56e7cee30393d5c2b989e562f73f6e853eb6467060c53e09abb41930a5c40fc09604d6114a08cda8
TLSH
T1B341EB58AAF91148B3776F5AABF7A86D487F78772E06905E00110E4F0666B40CDB2737
MD5 SHA1 SHA512 TLSH

Submit Download