hxxps://drive[.]google[.]com/file/d/1qC7FN1YGK2Aqu9tjXfhXW8t9kBLMe9LB/view?usp=drive_link

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/10/2026, 22:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://drive.google.com/file/d/1qC7FN1YGK2Aqu9tjXfhXW8t9kBLMe9LB/view?usp=drive_link
Sample261020-2x3nwsys4l

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
111	4220	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	drive.google.com
8	drive.google.com
15	drive.google.com
22	drive.google.com
47	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4220	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{8BC2980D-2B9D-4122-AFBB-70A7D9C88131}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1804	msedge.exe
1804	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 5800	2276	msedge.exe	84
PID 2276 wrote to memory of 4220	2276	msedge.exe	86
PID 2276 wrote to memory of 3792	2276	msedge.exe	87
PID 2276 wrote to memory of 3792	2276	msedge.exe	87
PID 2276 wrote to memory of 3792	2276	msedge.exe	87
PID 2276 wrote to memory of 796	2276	msedge.exe	88
PID 2276 wrote to memory of 796	2276	msedge.exe	88
PID 2276 wrote to memory of 3328	2276	msedge.exe	89
PID 2276 wrote to memory of 5564	2276	msedge.exe	90
PID 2276 wrote to memory of 3328	2276	msedge.exe	89
PID 2276 wrote to memory of 3328	2276	msedge.exe	89
PID 2276 wrote to memory of 5564	2276	msedge.exe	90
PID 2276 wrote to memory of 5564	2276	msedge.exe	90
PID 2276 wrote to memory of 256	2276	msedge.exe	99
PID 2276 wrote to memory of 5540	2276	msedge.exe	98
PID 2276 wrote to memory of 256	2276	msedge.exe	99
PID 2276 wrote to memory of 5540	2276	msedge.exe	98
PID 2276 wrote to memory of 5036	2276	msedge.exe	101
PID 2276 wrote to memory of 5376	2276	msedge.exe	108
PID 2276 wrote to memory of 5376	2276	msedge.exe	108
PID 2276 wrote to memory of 5376	2276	msedge.exe	108
PID 2276 wrote to memory of 1724	2276	msedge.exe	109
PID 2276 wrote to memory of 1724	2276	msedge.exe	109
PID 2276 wrote to memory of 1724	2276	msedge.exe	109
PID 2276 wrote to memory of 6084	2276	msedge.exe	110
PID 2276 wrote to memory of 6084	2276	msedge.exe	110
PID 2276 wrote to memory of 3512	2276	msedge.exe	111
PID 2276 wrote to memory of 3512	2276	msedge.exe	111
PID 2276 wrote to memory of 3512	2276	msedge.exe	111
PID 2276 wrote to memory of 5544	2276	msedge.exe	112
PID 2276 wrote to memory of 3556	2276	msedge.exe	113
PID 2276 wrote to memory of 1476	2276	msedge.exe	114
PID 2276 wrote to memory of 5152	2276	msedge.exe	118
PID 2276 wrote to memory of 5152	2276	msedge.exe	118
PID 2276 wrote to memory of 1804	2276	msedge.exe	119
PID 2276 wrote to memory of 3520	2276	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1qC7FN1YGK2Aqu9tjXfhXW8t9kBLMe9LB/view?usp=drive_link
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffe2235c188,0x7ffe2235c194,0x7ffe2235c1a0
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,14433946088985322993,12180756016486856810,524288 --field-trial-handle=2644,i,2212077162270111638,13396697740233912999,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,15356268706989493669,11896214094766223294,262144 --field-trial-handle=2644,i,2212077162270111638,13396697740233912999,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:2
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2208,i,8521382576709199600,3362669297887961930,524288 --field-trial-handle=2644,i,2212077162270111638,13396697740233912999,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,774276328984288936,1168568872616293035,2097152 --field-trial-handle=2644,i,2212077162270111638,13396697740233912999,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,12344397435737448640,4120537630839294068,2097152 --field-trial-handle=2644,i,2212077162270111638,13396697740233912999,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,6715761025441408198,13904648169959680972,524288 --field-trial-handle=2644,i,2212077162270111638,13396697740233912999,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,4037101031128080054,15945413720737786923,524288 --field-trial-handle=2644,i,2212077162270111638,13396697740233912999,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:256
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,17818731358099763105,7420627073221524243,524288 --field-trial-handle=2644,i,2212077162270111638,13396697740233912999,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,17818731358099763105,7420627073221524243,524288 --field-trial-handle=2644,i,2212077162270111638,13396697740233912999,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5992,i,12838215610224759554,9819368325724634582,2097152 --field-trial-handle=2644,i,2212077162270111638,13396697740233912999,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6236,i,16211901757291710731,1315813627620034042,2097152 --field-trial-handle=2644,i,2212077162270111638,13396697740233912999,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,17657280450662790310,13731784682467816708,524288 --field-trial-handle=2644,i,2212077162270111638,13396697740233912999,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6036,i,13064168431323454763,16076978862875493856,2097152 --field-trial-handle=2644,i,2212077162270111638,13396697740233912999,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,6546477790802568434,14804270841219327954,524288 --field-trial-handle=2644,i,2212077162270111638,13396697740233912999,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:8
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,15368262610683213656,1164563966780617925,524288 --field-trial-handle=2644,i,2212077162270111638,13396697740233912999,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,13672360980413939067,8516022205683517679,524288 --field-trial-handle=2644,i,2212077162270111638,13396697740233912999,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3996,i,7398184314443665219,16676787160530610947,524288 --field-trial-handle=2644,i,2212077162270111638,13396697740233912999,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5136,i,1654832558709401985,7845186788210873205,262144 --field-trial-handle=2644,i,2212077162270111638,13396697740233912999,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,8608486674423220153,10748022933765353711,524288 --field-trial-handle=2644,i,2212077162270111638,13396697740233912999,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:3520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

13bb1d92-6b06-4f0a-a1f9-51296231c1c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\13bb1d92-6b06-4f0a-a1f9-51296231c1c5.tmp
Size 25KB
SHA256 3ac161acb59cb9f6e18d58acb710aaf4e9e98b2b9bcebee55d2283ef5d14c5e9
MD5 44cba0c371547d281f63784c32ade76a
SHA1 76e68da7cae7b9db3700e904c33411dc30f9af89
SHA512 c46ac861189893ec833c01661b2967f1b314bb7c49639af4fb252cc52d92d630f897e8607445e4c4bc6e244be91dc5a4bb6ecd8d5c285d386f4fc22c6eab8574
SSDEEP 384:nSiFiZcI63sNZ8TUNTUlIm25mg5dnK2flBCupuSAiOSsa+VYqgL/7IzaoQ:ZFQ63owgSqJBnpf4ShgCz
TLSH
T1D5C25C36EC99DDBBECEA8FD9A74A7A07DEE40163959C8AC0DAD95D1C00871DD0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4fcdf940-bea5-4170-9737-90571d21cabd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4fcdf940-bea5-4170-9737-90571d21cabd.tmp
Size 26KB
SHA256 4e89fc5b39b0099b4699e6281dafed7825e1c4cc4322d531c8ecfa9f30254023
MD5 c4820283fe48f7af2c2a89b329be1598
SHA1 35a57be1f5a32567c22cd029cbc75159437ca1a0
SHA512 5b4070e42fa16d4ee0844be4bb78e3c5330e957b3026d70d288a629a630dfc67bbcbdd30cac8db73d6cc9609e104b4ff5bd7af73eea2ab1600ad99ffb6179c8b
SSDEEP 384:nfiFiZcI63sNF8TUNTUlIm25mgvdlK2flBCupuSAiJGasa+VYqgL/7IzaoQ:qFQ63UwgS6PBnpfKahgCz
TLSH
T1F2C25B36E894CDBBECEA8FE5A74A7603DEE44253959C9AC0DAC95D5C00DB1DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

011091fa-62d3-4a2a-bb05-0c8f47225f8a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\011091fa-62d3-4a2a-bb05-0c8f47225f8a.tmp
Size 12KB
SHA256 0af4203c55bcbd4fdd15d9bdd8e6672d998abcbc26510b731d51e6eb8189665e
MD5 401e33c1659e1780c19f1b35cc1fe669
SHA1 130df74744efe8d4c10559025b786ece172257bb
SHA512 5e65fd3b86111c4c50fd502fe27a249e9652829aece4a28e24453fa233c87b24398006982c0c94470ee7ad640dbf8a05f291d12db0904b4089e791e14d8e7795
SSDEEP 192:sxZpRZk2/fbsgQZZ+pzodpXoVHW6+WNysT5XYbIBGYYF4Ig5+BJJ:sxZpE2/fbsgOZ+C0HbfXFZYeoB
TLSH
T11342C715AD28AD3B8CC7D61AFB55BF53E7F91033A0951E44A6FC8A1C04EBADD220750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10267b6f-dd48-4f0d-a402-5753e347f7a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\10267b6f-dd48-4f0d-a402-5753e347f7a9.tmp
Size 414B
SHA256 f27ace0c7d0b64960186236c298c1c32f1dacbd0c458e30c8b1cec9c0db04a79
MD5 ddc900d70cd02c02d48b665c19f2c2d0
SHA1 fa33575334aca93429e9da10399b4bcb7cce3c04
SHA512 b2bf07f46bf91739f1dfce5dfbdb36f498b636f9e5a9a0890abad570ffcb8b50944b72057c67a19845a3e185f8a581ef396706fcd5a2ed7bb3f4eb339b24c389
TLSH
T1D4E02BE9CD16AC3709FD4B1850640645EB4113572A80858B373D801D8FB1A7A558696C
MD5 SHA1 SHA512 TLSH

Submit Download

4dd32e6e-3d16-4823-9fed-dc4d04702e7c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4dd32e6e-3d16-4823-9fed-dc4d04702e7c.tmp
Size 12KB
SHA256 89b754fd576e8eac36178d6502690193d7ebc7850af44a65b96403aab72800f7
MD5 9c8051317f6af4f0171188f4cf776b4e
SHA1 44a56dc2c264c788110c5aa548c7f363e52da78b
SHA512 282d262aa9f43ac05b7ba12e8e111fe401a6a4a0ccd989edff28182e8071d39f05babc74343b33d5b61cdfbeeadcb76340c85f7bfac7547a542da9a85cc7e039
SSDEEP 192:sxZpRZk2/fbsVQZZGpzodppRHW6+WNy0TE/YbIdGYYF4IgjBJJ:sxZpE2/fbsVOZGCDHbq/FFYejB
TLSH
T13842C715AD28A93B8CC7D61AFB15BF53E3F91032A0945E44A6FC8A1C14EBACD220750F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f6e2179-abe7-4d6c-86ec-8a544f721c1a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9f6e2179-abe7-4d6c-86ec-8a544f721c1a.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 0baafe4b26cea3832cca8b596757db222f9eeb9b4e708bcb7c52306c6465cf49
MD5 e9b81bb82a543aff9ad1df5688896b46
SHA1 83fba15442cff025552b7344e04571d01c838e85
SHA512 6e00590609652716a7925e36574af0273b6e4e2c0b998b98fe93387a1b6a1b858b4814a0b1a746971a107eaf94e06cde3549ed32c6f99a96e1e2a81667472e05
TLSH
T14C510D43A69076D9FF942AB39CF24B4371F16086B64F4FB21B94E3B4786270E5194770
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 76f3c64e549d5b7821c8f5710dcf1b4ceca9d152a12578b018c0b0e05c20f05a
MD5 8fb25cc3c7da2ee1d044244de1c55135
SHA1 a3953b1be719a279401fac8733c782de74424322
SHA512 f2a90fa0456729b8b9c5cceb82dcef00356b5e43917af80c080ead7e1a206193fead6861cac9d2dc622fd3fc646a2faa3db3d8c50ed80a9a4774b46abf0ec2b1
TLSH
T1C3511B838A807ADDFFA411B385F5138335F0B442968F9F320BA8C3796853B0E9198770
MD5 SHA1 SHA512 TLSH

Submit Download

f4912378-439f-4b3c-9d62-35eae80c19fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\f4912378-439f-4b3c-9d62-35eae80c19fd.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

30ea30c8-2881-4707-a2d8-82547529c093.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\30ea30c8-2881-4707-a2d8-82547529c093.tmp
Size 7KB
SHA256 4692e33fb6586fef4309e054987c83076c0a2af805d7c3224d50800b4c93acfd
MD5 f0c752b84b1fd76680787187b76e8a8b
SHA1 4e303ea3d7ca7f796569d95f2b020b637119eb01
SHA512 05a315e1fc72b8274b869d93df487a6d27555e9ceb65a47b30111c6918d1aa06e1c5827557230037ade52b4941cb6aadd3f54f371a743df235e24c213d1a7cee
SSDEEP 192:D1GW/8veJ8S2tw8aa5c/s5HV4I5KZSjQfNp+mT:D1GW/8veJ8S2tw8aa5c/s5HV4I5KZSjo
TLSH
T1B3E18BF7C7E8826DC80156F49B15AF1ECE2E1618431C3D2AC8D8BE5BA3E2431E25565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b96a0f8-c5a6-4d02-9b5a-d161fa0f4419.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5b96a0f8-c5a6-4d02-9b5a-d161fa0f4419.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

aef992fd-8f23-4e30-89d0-7b44d9c61da4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\aef992fd-8f23-4e30-89d0-7b44d9c61da4.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 7e541cab56f061a114ad55e5a602f77d341e37213d32f44409a804aa5473c3e6
MD5 ac66ee4d57d563d4c61a8504595b60db
SHA1 6b7175dd249ce9558ca782fd42f7b634b0a4e48b
SHA512 9179f6f44d65b8dc1c34a9ed5dbe403bfb249243c928fb390fce18059ab3059d5ad98422971a2e116f27f4da8dd2ac1a663f3f8c571b66575263305282f9b334
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXSZDU+nyOwsYVMhKWq3:OtfFvpopPxrB4RhfS9y
TLSH
T15CB2311571BA021138FE690C81B58B2F064232B37158E63B7FBD15A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

c0ec1726-fa35-4535-9b97-adb5305ac315.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c0ec1726-fa35-4535-9b97-adb5305ac315.tmp
Size 12KB
SHA256 f519e57fc51ad7b4fa3aa49000d317019370ea989b1502e2c7489d88d1ca25c8
MD5 f500b829f1f17a9c105f3ae8812666fc
SHA1 f0af3674c82f408052c68c7dd7512114a6bcda28
SHA512 1f443dfd50f4fc2a44b585fd664fdbfa90c08fbf87fe92edd2011f9f5229bc2f8dea87e6140eac3ba295b5d561b51fbdb2657cbb1b4872ac93283a46e460508c
SSDEEP 192:sxZpRZ92/fbsmQZZ+pzodp6uoVHW6+WNysT5XYbI3GYYF4Ig5+BJJ:sxZpd2/fbsmOZ+CMHbfXF/YeoB
TLSH
T13542D716AD28A93B8CC7D61AB755BF53E3F9503390D51E44A6FC8A1C04E7ADD220750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfeca49e-9df2-4090-8050-66ee8f5d05ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cfeca49e-9df2-4090-8050-66ee8f5d05ab.tmp
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be3b2c79-21f0-4913-accd-ca5e59d9afdc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\be3b2c79-21f0-4913-accd-ca5e59d9afdc.tmp
Size 32KB
SHA256 3888b30f242d4732298b74b0f6bf7c2a74d30688942fb8f3f9b2e5093a2bf0e1
MD5 3edfa43c095bdc36313b1a1606dfa4fe
SHA1 cf7b9b417ced17edf51e77c9df98d5d73a41c577
SHA512 b935b84035557dbd6d9fa2bcb396abe70e47d0ae0cb6048b50a0fb2a1aeedbc4d9b04193ef1125d6425a9c87ebc12946d6a6519fa451c053dd9896613fb7e4d8
SSDEEP 384:nNiFzQkUSvmj3sNZ8TUNTUlI4Z5mgb352K2flBCupuSAiJ3aMT5PgL/7IztIIlP:EFdo3Ewg5G5MBnpfbaMTzLV
TLSH
T1E3E2B2F698D79977D89E4B97A33D2E029AFCC113B5984A84B7C91D1CCC861BFD306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c84feb63-7974-4c29-92d5-be61d47ebd81.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c84feb63-7974-4c29-92d5-be61d47ebd81.tmp
Size 26KB
SHA256 f243569059340c94de39aaddf4a0abb00bc202d19a8991a9f02dece37c2f6479
MD5 d275bf579a043ccebde2ac73d38bec90
SHA1 aaa8e2841269cb350a644ab63e75f2bf9e68654c
SHA512 25678b35fa8f00d214947388308cf17d636870e2d4edd68660c1d49d7ae89717b9152893f12d0ff67c8485dde8c10e0eae5f3305e16ab62dba297e629cba9270
SSDEEP 384:nDiFzQkUSva3sNZ8TUNTUlI4Z5mgbM52K2flBCupuSAiJaaMT5PgL/7IztIIlP:uFda3Ewg5b5MBnpf+aMTzLV
TLSH
T160C24B36E8A5DDBBADEB8EA5A30A3643DEE04253C99C4AC4DACD5D5C00CB1DD130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f0f583d6-147a-4cce-bbbd-0d804e527cab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f0f583d6-147a-4cce-bbbd-0d804e527cab.tmp
Size 26KB
SHA256 5f035d57efd93ebceac3edc9c273df790056f481f943fd07cd42b7d2b0f837a9
MD5 b8caf6d7e681d34e0c778ec4b775ef1b
SHA1 56e746d2f00dcd482e0fae10d385c161350af856
SHA512 efdc81f34312772e466d072ce5e875cf63c3b6f2f5cb3d3b01172b28ecae08b016c1a115973fd1f6059f8a40efe05c5d765c6926861c2bbbbb739866438c0c09
SSDEEP 384:n9iFzQkUSva3sNZ8TUNTUlI4Z5mg4goK2flBCupuSAiJaaMT5PgL/7IztIIlP:0Fda3Ewg5oOBnpf+aMTzLV
TLSH
T171C24A36E8A5DDBBADEB8EA5A30A3643DEE04253C99C4AC4DACD5D5C00CB1DD130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1671d4e620e199d65cceb664fddeb6b0096e5485f7bd22bacb9fe1dcdf9afd72
MD5 5e86427d0565bf0de6ce8278e8496b8f
SHA1 c1a7bdeeb1a4ee265d61064208a6de8ad52008c6
SHA512 69c750c86322593eae043775f89a957f9f9fc88d4c669d1c23afe27cbf607f0ba692180e043f1154ccc78cf54e6e085e9988984e5207faf67e98288103c41376
TLSH
T1A341F968B6F91149B3B76E599BF6686E847E79633E0AC09D00110D4F0633A40C571B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5036-273-0x000001F8DFEE0000-0x000001F8E0EE0000-memory.dmp

Download