hxxps://drive[.]google[.]com/file/d/1WdcomjfPXzIy8zbLxCy5W6UU3UFkjkP-/view?usp=drive_web

Resubmissions

05/10/2026, 13:00

261005-p826aaxtfs6

05/10/2026, 12:56

261005-p6ra1aww3l6

Analysis

user interaction
yes
max time kernel
149s
max time network
143s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/10/2026, 13:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://drive.google.com/file/d/1WdcomjfPXzIy8zbLxCy5W6UU3UFkjkP-/view?usp=drive_web
Sample261005-p826aaxtfs

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	drive.google.com
6	drive.google.com
11	drive.google.com
19	drive.google.com
44	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5924	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1826067017-2692080558-3687773357-1000\{ADDBABAC-F898-4218-952B-8B77AC7A4A20}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
224	msedge.exe
224	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 5816	5028	msedge.exe	82
PID 5028 wrote to memory of 6120	5028	msedge.exe	83
PID 5028 wrote to memory of 5924	5028	msedge.exe	84
PID 5028 wrote to memory of 6120	5028	msedge.exe	83
PID 5028 wrote to memory of 6120	5028	msedge.exe	83
PID 5028 wrote to memory of 4332	5028	msedge.exe	85
PID 5028 wrote to memory of 4332	5028	msedge.exe	85
PID 5028 wrote to memory of 3060	5028	msedge.exe	87
PID 5028 wrote to memory of 3060	5028	msedge.exe	87
PID 5028 wrote to memory of 3060	5028	msedge.exe	87
PID 5028 wrote to memory of 4436	5028	msedge.exe	86
PID 5028 wrote to memory of 4436	5028	msedge.exe	86
PID 5028 wrote to memory of 4436	5028	msedge.exe	86
PID 5028 wrote to memory of 1224	5028	msedge.exe	91
PID 5028 wrote to memory of 1224	5028	msedge.exe	91
PID 5028 wrote to memory of 1224	5028	msedge.exe	91
PID 5028 wrote to memory of 5908	5028	msedge.exe	92
PID 5028 wrote to memory of 3712	5028	msedge.exe	93
PID 5028 wrote to memory of 5908	5028	msedge.exe	92
PID 5028 wrote to memory of 3712	5028	msedge.exe	93
PID 5028 wrote to memory of 384	5028	msedge.exe	94
PID 5028 wrote to memory of 2064	5028	msedge.exe	96
PID 384 wrote to memory of 3756	384	msedge.exe	97
PID 5028 wrote to memory of 1976	5028	msedge.exe	100
PID 5028 wrote to memory of 5068	5028	msedge.exe	101
PID 5028 wrote to memory of 5576	5028	msedge.exe	102
PID 5028 wrote to memory of 2804	5028	msedge.exe	103
PID 5028 wrote to memory of 2804	5028	msedge.exe	103
PID 5028 wrote to memory of 4520	5028	msedge.exe	105
PID 5028 wrote to memory of 4520	5028	msedge.exe	105
PID 5028 wrote to memory of 224	5028	msedge.exe	106

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1WdcomjfPXzIy8zbLxCy5W6UU3UFkjkP-/view?usp=drive_web
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ff87de9c188,0x7ff87de9c194,0x7ff87de9c1a0
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,16404996197533021245,1854713379943489845,262144 --field-trial-handle=2368,i,12327921375692582148,16142548341037629341,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,18428766362001569682,1917279908693106057,524288 --field-trial-handle=2368,i,12327921375692582148,16142548341037629341,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,9560329482553653243,181209300344479136,524288 --field-trial-handle=2368,i,12327921375692582148,16142548341037629341,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:13
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,13078445293717115500,6279337906027496109,2097152 --field-trial-handle=2368,i,12327921375692582148,16142548341037629341,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,17730088613445187186,2913659324633661947,2097152 --field-trial-handle=2368,i,12327921375692582148,16142548341037629341,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5000,i,463898546091449658,1867484278020613070,2097152 --field-trial-handle=2368,i,12327921375692582148,16142548341037629341,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,13650930761135218819,15490230995740818835,524288 --field-trial-handle=2368,i,12327921375692582148,16142548341037629341,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,4490840007797141584,8098033545460139950,524288 --field-trial-handle=2368,i,12327921375692582148,16142548341037629341,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,9418862143537839082,392395296935872823,524288 --field-trial-handle=2368,i,12327921375692582148,16142548341037629341,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:384
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,2495935957845505835,13687106844092530784,524288 --field-trial-handle=2368,i,12327921375692582148,16142548341037629341,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,2495935957845505835,13687106844092530784,524288 --field-trial-handle=2368,i,12327921375692582148,16142548341037629341,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,3737065525179018945,10193529560454030721,524288 --field-trial-handle=2368,i,12327921375692582148,16142548341037629341,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,16539177225214212323,2413831126684320264,524288 --field-trial-handle=2368,i,12327921375692582148,16142548341037629341,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,606392581171650639,9371420213444874298,524288 --field-trial-handle=2368,i,12327921375692582148,16142548341037629341,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,4423497071801840357,8570268714748662281,524288 --field-trial-handle=2368,i,12327921375692582148,16142548341037629341,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,4089518832979064898,10786211405613165271,524288 --field-trial-handle=2368,i,12327921375692582148,16142548341037629341,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5400,i,15786795121635028369,10976050005867953664,262144 --field-trial-handle=2368,i,12327921375692582148,16142548341037629341,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2b1e9aab-d6b7-497b-b0f7-62afbc0b8d54.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2b1e9aab-d6b7-497b-b0f7-62afbc0b8d54.tmp
Size 27KB
SHA256 f78f082b9470434b865fc96e74e8ead83faf71c58862c4c940c3a3bc516ab374
MD5 83022a59c9e377f33f80cecb563c6f19
SHA1 c9b0439daeb1569ca91951d66c3f9c63fcfc5e53
SHA512 685afd4cefd7d04d008d822af70bf6e2365335f9b6a3dcb0a248d7ced1c74c732554645f43a23b32a453d5e8446e7fba89ca96e7e750f7b8aea1c822f0119aaa
SSDEEP 384:nPiFiZcIR38NV8TUNTUlIRbCC7W0sxbdP2xzyfoBj+khDPNRhnVZh6DKhHWIgL/n:aFQR3ywgwCUbJMdBSMDlDnfYGHWrUa
TLSH
T12DC25C32ECA4C9BBEDEA9ED5F74A7A03DEF04153958C9AC4D5C86D1D00971AE1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3c85a492-7476-4b5b-aef7-e46948462a07.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3c85a492-7476-4b5b-aef7-e46948462a07.tmp
Size 25KB
SHA256 c93cc9c260438b258aaee91259d02687be98d0c0e56b08a39c931b7ab699a2bb
MD5 9b787980973239b4c5379fac95fb3d81
SHA1 5761062e5b48ea0167eeec04698c2f280df25079
SHA512 d63e7e04399e9ab2e2538380fbb9e8ec7ac6febcae93e8c0bccfad6f5feebed94f2fd505968940e57f39b3a696ee159174e31f8517f85375cc5ddaac01a1b80a
SSDEEP 384:nHiFiZcI638N+8TUNTUlIxBCC7J/GcxzyfoBj+khDTW9v4EW1XoU1ecgL/7Izs0G:CFQ63NwgCC9GWdBSMDK9IoUDG
TLSH
T124C24C36ECA4C9BBECEB8FD9E74A7A03DEE0416395AC99C4D5D45D1D009719E0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55c23339-7110-45c8-ae41-4594997238e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\55c23339-7110-45c8-ae41-4594997238e5.tmp
Size 32KB
SHA256 ff0468789513365277ef0a3ac4e478a610a4a52885225994be5b2d526f335dfe
MD5 de69ae934b15fb5612c284cd151e3869
SHA1 a4bcf6c1dd0e0536f4ad4fd4b1ab0c7081b26c8f
SHA512 fbb93d1fb121619b46f3bcbab8e8b9188eed92fe6de21785522466fb355b8b3cc474b07e60ac03cfc59737de3c3dad79dd7cebc6cee1f94e380a790690a87434
SSDEEP 384:nViFiZcIK38NV8TUNTUlIRbCC7W0sMbdP2xzyfoBj+khDPNFdnVZh6DKhHWIgL/n:cFQK3ywgwCHbJMdBSMDlznfYGHWrUa
TLSH
T17BE2A2F298D389B6E8EE4B87A73D2D0299FCC153B5489A84B7C45D1CCC961BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ef8e0a91cc3656fe639527b7c461215de3584a9b32168d8efc58c800c3fcf45a
MD5 7611be076e62556d26aa1ad65d6c21ee
SHA1 3b62033283275e165c1cdb998b2b174841695892
SHA512 949a38fce52f98059e4356f1465fa0cb57397b5b5a79c468fea50c81a884f46ee37ab38ecf492df88f7280e9e041eedad365f8eab019be95f1d7b37d95794929
TLSH
T110D02B58EFD58290D432343A4075428532CFA504D1035200E0D0011319C11410061865
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 00fd53d4e341ca585361bfbe699a2c8a3fdbc255133db935051b0958a30a7abf
MD5 e720824e80db33ac2843bf1ebb30faec
SHA1 f511d38f1de46ab026d3c6963050a3f1f512b92d
SHA512 09eb559f6018245581b30678d5f9952fcadb0adcee197127c7448f39c53ff841dddd8b077678d837d33d8e01126c7d80b7ec77764938cb5368f955ce628ed81c
TLSH
T1E3D02B5CEFD99290D436343A4035428531CFA904D1035200E090010319811410061865
MD5 SHA1 SHA512 TLSH

Submit Download

165149a0-1507-4cc8-abe7-e7b41f358bdd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\165149a0-1507-4cc8-abe7-e7b41f358bdd.tmp
Size 28KB
SHA256 fab72c4fe3c99ab9934eee2cfcc91283a80567fca7823fdade8be2534bb752d6
MD5 6c4e55d79d9c24e573bcbfa1c93df27c
SHA1 4d5967ef799200ed9ffea00654c29a39439ccd29
SHA512 bfcfb3540a21332267332106fb17852b74ca0e61d49f727a7f20d1f446e070d8423dd743951d3689bbf687051d4d0a4dc8c5a5547cff96d7b46235aa0a4197e5
SSDEEP 768:AvmgC8Ba29tWRmpbQPL8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3HgLl/jR0sVYroTN:AvmgC8Ba29tWRmpbQPLu1jaKHgLpj+sH
TLSH
T127D2093B640CCB7E4FC04E9DDD266F966EE802D7AA588D4047FA894C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 bab47861a093e5e6b0b6cc7ca918a74fb8760730440a337de6df6c277f7b0bb0
MD5 22e5abee3518fc9948c52b89ff64862e
SHA1 b4b62b556920c9320e19af5f614717f9fcd33eed
SHA512 7682e13f95121a2def4207e1b9b9d7d9d65306ff831de8b786751ec280d3aaf2a5413235a252abdba4abdeb5e8c0cb31970d99d3ef9407f0d7238c6bb439b1f4
TLSH
T1FCE026E425CBC22EA70B74C7016C530D8390371F93C0690E5704C984B805898F2DABE4
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 5d7d65bc8b12fa13ad9c3814c48c2583c95e130896751d914c33a0eb0dcaa720
MD5 a7cc65fde9c4044a7b02ca6b9255ee1a
SHA1 58473c281658ae692b9684f38c08e94abafb4081
SHA512 34c2dc50ad25acb63b6e18e40b611a8867351f68189d39ff19aba6046c9a9bffdadf92faa264bf1f4cdd6b8009d65d7bfd0f870ec8ecf742d0abd2b61a833323
TLSH
T1B9F0F4A9CD21BC3B18FD1B6D20945B4AFB9013672A50995B3A3DC10C8FB563B8685C5C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 7ce1633b13266d9c30fc2dcacc181064c45a5c47dd29284388e525ea58bb40b7
MD5 cd41114bf5d072d1d9803a5577e0cb25
SHA1 696a22d0cdbf3c2ca66319b418f700cea085987a
SHA512 729da14f74d07abb47601ee5a8e252d54cab7580858713fa962b329e75d3b1c52ef731836d9053d556273382ae1dae3a2c649d4d0904609c2275ed28ac796c8b
TLSH
T1CD71A58CC9A104B9CF644338A1C1849B3771A28575873DFA87DCE479BC8A35BDE3C984
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f6d966acf2a20e55c4845b8e4a8c61a487ccaa70ed4e4c568ecb3a7e8c8c4422
MD5 af4ea730ce17cf4185815b5da2eebc78
SHA1 19727a22ccdfeb315c0b1b884badfa2da877eb34
SHA512 a9b7f8ad238b270ef0cea758ce8d7476e073dc4453f1fc250263c65377c25ef93b8fe41bceaa3b3bd3cc94bac7f1bbbdc9f86c1b73b79ab91a03f4a6beb57cd0
TLSH
T199613C8CC8A044B9DFA4973861D5948B3BB1A28576473DFA07DCE4796C0A39BCC3C188
MD5 SHA1 SHA512 TLSH

Submit Download

34785d78-813e-43ea-8c01-e929197b99cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\34785d78-813e-43ea-8c01-e929197b99cb.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

5645cfef-62dd-489a-96c0-ba21662aff67.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5645cfef-62dd-489a-96c0-ba21662aff67.tmp
Size 7KB
SHA256 a409bdc31f34f960e879e96f2804aae87c44b4be2d8be64f45a4ef4dc4d95d34
MD5 ac13c4dc91122543be32b617e7ca025a
SHA1 23e3166c8ede4f860391631c2c1bbd3de9e6303a
SHA512 7908d1ca9f847dc0f7851bc8e272ed08890c3f81ef60e916a9bf6f5014fecdfbb33d8cf2fbe790460aa764cd54ddd75f1cebe70de13b36be016c32b8731365fd
SSDEEP 192:D1qY6IhiTIrw4RHruvaRk7uCMPURWxzsK1r0mW9:D1qY6IhiTIrw4RHrYaRk7uCMPURWxzsb
TLSH
T11AF16BF7C3D9C22DC90156F4A715AF2FCE2D0A18531C3D2A88D4AE6BD3E2431E25565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ba6d97d-33e5-4805-81ee-dd2dc1e04ee4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9ba6d97d-33e5-4805-81ee-dd2dc1e04ee4.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

b56c3266-4b17-464e-8ace-7affdeec9e30.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b56c3266-4b17-464e-8ace-7affdeec9e30.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 c1ccb80ee1fc3c0c456c78d92b6b06d03298ac22d67856eb249e678ffa6d3928
MD5 1a45d5f5b984619994a10f8e3d288e9d
SHA1 2e7a6b2453d088bbc9acb76c27526b46977b762e
SHA512 2fa43a575df7df6d14f195ae0c48617a68436c59ba28a68d1827f366956a6a51b20771a7965e66d196b40d19d266edbf41a2798fd10e05e8c3839122641fcc37
SSDEEP 96:K4JaKygi+ZSKiIX6cKTKE+9eKOUV9eKukoWtGKEgrhOKKQk6QgKFKWDCK4AiyAgT:ohdNdBzXXFPXgRbKvtp0JlznyLlr
TLSH
T1F9B2485131BA12593CBE350890B5972F528135B3711CEA2B7FFD00A68E6BE485DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a17c3387-71a8-4017-80ae-8f0a84d467d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a17c3387-71a8-4017-80ae-8f0a84d467d6.tmp
Size 12KB
SHA256 fd5613bab8d79b16a2f34427e091939097950b92a32f0a0ab31ce3c3cf8d2707
MD5 c1ccb9443cddac22927bf4dda6eae0c4
SHA1 59b9cc1bb49cd6606a65af06fa8b421efe65c98a
SHA512 1d9683fe2ae161a9da408450a6644f0602ddc676803865ab37ac7c3a5aca682b60a62807379b2323bc73c61652d0d8afb30aaf0ba79084157062c4f75c1734cd
SSDEEP 192:sxZgRrF3/fNs+LII1ZqMqBzodpD0z5/W6+WNywf/Y0gTWu6uRaQ/Ig5J0UJ:sxZg73/fNsIF7q68/bB/5+P64a83F
TLSH
T11942C4566E24A97B8CC7D61ABB15BB53E2F9103290D15E48AAFCCE2C11E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab066d33-9ec1-44f4-9103-7cd930d9a27e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ab066d33-9ec1-44f4-9103-7cd930d9a27e.tmp
Size 12KB
SHA256 7cbd8e7d248eff0ce71140a6c0d786d86cd8c2c050b044e7c5cbcc906acf41e5
MD5 d222b8f34b123e422900353965fbfe76
SHA1 2157a9fba60df27e0fdac295f12823815b971b99
SHA512 faa5b60bf87720471cf1f18bb32cbad36bbae36ac6fdc493f1b992aa3a59f2a3b3a39d1fbc79b963562878f6a305e115e2d81a4efb08bd44b81f238ba1220da9
SSDEEP 192:sxZgRrF3/fNs+LTI1ZqMqBzodpD0z5/W6+WNywf/Y0gTDu6uRaQ/Ig5J0UJ:sxZg73/fNsIU7q68/bB/5+a64a83F
TLSH
T14B42C5166E24A97B9CC7D61ABB15BF53E2F9103290D15E48AAFCCE2C11E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1e69817-6a09-4606-ade2-ddb198f4ca5c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b1e69817-6a09-4606-ade2-ddb198f4ca5c.tmp
Size 12KB
SHA256 a57d88a99168313b3618a568d1dbb9a95375cd7da2ccc27c70a492f5f9dd1e80
MD5 ae19a871569a45592872eed3dd7e2e3c
SHA1 21215a2831417be3561e3126e07e1de9725b1b74
SHA512 0aaea29fda0b1a42e5e9294e6666a921bf591f376594c63ad4bc5b4275c5f252fe33ccbaee4bbb586f628e6c9f8cea8278d77d9be8e61d0f8e0764a73ee680d3
SSDEEP 192:sxZgRrF3/fNs6LTI1ZqMqBzodpD0z5/W6+WNywf/Y0gTDu6uRaQ/Igj0UJ:sxZg73/fNs0U7q68/bB/5+a64a8jF
TLSH
T1C742B5166E28A97B9CC7D61ABB15BF53E2F9103290D15E48A6FCCE2C11E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d82f52da-6606-427e-b083-7e550cd4aa8e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d82f52da-6606-427e-b083-7e550cd4aa8e.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b1936054f121bcd9c215ec379650beda8626ad2a59e6c435c59c9a2d072fe592
MD5 f180e3309e98d7d64afd86f48b463709
SHA1 eb063865903f27789508c7d3937216f630651424
SHA512 37709cee753b23a2ebf60911797728bdf1446871b62fe85a10a1bb2f62b79225270465d1e038baf97ca01a17d0752c5f3db635ec61540566e9e1b368f85d02f4
SSDEEP 384:nciFiZcIR38NV8TUNTUlIRbCC7WqsxbdP2xzyfoBj+khDPNRhnVZh6DKhHWIgL/n:HFQR3ywgwCSbJMdBSMDlDnfYGHWrUa
TLSH
T174C25C32ECA4C9BBEDEA9ED5F74A3A03DEF04153958C9AC4D5C86D1D00971AE1707C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download