hxxps://drive[.]google[.]com/drive/folders/1cjAKJ-jS2Zg5q5UbhbxKSrCpp9qITX8E?usp=sharing

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 06:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://drive.google.com/drive/folders/1cjAKJ-jS2Zg5q5UbhbxKSrCpp9qITX8E?usp=sharing
Sample261024-hmf8csgt71

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
25	drive.google.com
49	drive.google.com
78	drive.google.com
7	drive.google.com
8	drive.google.com
15	drive.google.com
21	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5512	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{0396F391-45F1-4A5C-A101-2567207C15D8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6104	msedge.exe
6104	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 5536	1296	msedge.exe	87
PID 1296 wrote to memory of 5268	1296	msedge.exe	89
PID 1296 wrote to memory of 5512	1296	msedge.exe	88
PID 1296 wrote to memory of 5268	1296	msedge.exe	89
PID 1296 wrote to memory of 5268	1296	msedge.exe	89
PID 1296 wrote to memory of 3432	1296	msedge.exe	90
PID 1296 wrote to memory of 3432	1296	msedge.exe	90
PID 1296 wrote to memory of 4264	1296	msedge.exe	91
PID 1296 wrote to memory of 5760	1296	msedge.exe	92
PID 1296 wrote to memory of 4264	1296	msedge.exe	91
PID 1296 wrote to memory of 4264	1296	msedge.exe	91
PID 1296 wrote to memory of 5760	1296	msedge.exe	92
PID 1296 wrote to memory of 5760	1296	msedge.exe	92
PID 1296 wrote to memory of 4576	1296	msedge.exe	95
PID 1296 wrote to memory of 4576	1296	msedge.exe	95
PID 1296 wrote to memory of 4576	1296	msedge.exe	95
PID 1296 wrote to memory of 5972	1296	msedge.exe	102
PID 1296 wrote to memory of 5972	1296	msedge.exe	102
PID 1296 wrote to memory of 4664	1296	msedge.exe	103
PID 1296 wrote to memory of 4664	1296	msedge.exe	103
PID 1296 wrote to memory of 440	1296	msedge.exe	105
PID 1296 wrote to memory of 1616	1296	msedge.exe	113
PID 1296 wrote to memory of 5244	1296	msedge.exe	114
PID 1296 wrote to memory of 2264	1296	msedge.exe	115
PID 1296 wrote to memory of 464	1296	msedge.exe	117
PID 1296 wrote to memory of 464	1296	msedge.exe	117
PID 1296 wrote to memory of 6104	1296	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/drive/folders/1cjAKJ-jS2Zg5q5UbhbxKSrCpp9qITX8E?usp=sharing
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffa5946c188,0x7ffa5946c194,0x7ffa5946c1a0
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,5430617100117714975,17480553388605316177,524288 --field-trial-handle=2348,i,1456763557641323845,5779512609453343082,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,2920867294715900928,1865620444809061643,262144 --field-trial-handle=2348,i,1456763557641323845,5779512609453343082,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,5418775033727156882,3694720458646203105,524288 --field-trial-handle=2348,i,1456763557641323845,5779512609453343082,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,2926957442356011061,9442782006183562290,2097152 --field-trial-handle=2348,i,1456763557641323845,5779512609453343082,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,16781784691801634508,4470730119787051964,2097152 --field-trial-handle=2348,i,1456763557641323845,5779512609453343082,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4960,i,12405874662173916187,16671411530286081542,2097152 --field-trial-handle=2348,i,1456763557641323845,5779512609453343082,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,16595093382614472839,9439876292966913287,524288 --field-trial-handle=2348,i,1456763557641323845,5779512609453343082,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,13121095224645968898,172360098324938726,524288 --field-trial-handle=2348,i,1456763557641323845,5779512609453343082,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,1384219984457629514,5641746485845285741,524288 --field-trial-handle=2348,i,1456763557641323845,5779512609453343082,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,1384219984457629514,5641746485845285741,524288 --field-trial-handle=2348,i,1456763557641323845,5779512609453343082,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,17431967356960794843,4810898460273221538,524288 --field-trial-handle=2348,i,1456763557641323845,5779512609453343082,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,3157015984660024462,8886454112140020357,524288 --field-trial-handle=2348,i,1456763557641323845,5779512609453343082,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,8110487358891734065,11256475570185887491,524288 --field-trial-handle=2348,i,1456763557641323845,5779512609453343082,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,14271013536141324570,3526776636951281406,524288 --field-trial-handle=2348,i,1456763557641323845,5779512609453343082,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6176,i,15105816709017517618,16303426706403028607,262144 --field-trial-handle=2348,i,1456763557641323845,5779512609453343082,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6104

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

21d1c293-5298-4155-9e5f-1fdcf53cefc0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\21d1c293-5298-4155-9e5f-1fdcf53cefc0.tmp
Size 26KB
SHA256 444d1149390f709319618ed78397505a7aceff3dda3d4d7c74385c2fb5c6c5d1
MD5 d3d359007f0d053a3313c304eaff91b0
SHA1 56369c7dd6000aed1f23f42faffc4e0caabc187b
SHA512 3c3546a94f69cac2ea7eee1e3b000d84b731e0e345b35b60fdc9206b346c13c63a97d991e917d38037a0a8e3cfe243581b0cfce8e8ffaefbee072387b0186ae9
SSDEEP 384:nRiFiZcI63sNw8TUNTUlIm2aKMdZfwzWf/BChxMJXYIumihRsa+VY8gL/7Izno6:4FQ63FwgcFq4BChxMJXYIHi7hgRR
TLSH
T144C23B32EC98C9ABECEB4FD5A74A3603DDE04123D59C9AC0D9D81D1C00DB59D530BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3965b27b-3001-4ef1-ab26-4547c2290d0e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3965b27b-3001-4ef1-ab26-4547c2290d0e.tmp
Size 25KB
SHA256 f93e0cf820ef11d29e4e2431c413bbb8bd87f6471fe65bdc0a3f41536a98025c
MD5 29ff2bec6dd1dab55ac26c369461f0bd
SHA1 ff0522ad08373bfdce3c33aea3ab84d39f1484fc
SHA512 5af402165a712d2cc1fc20c9fb47c154345da9e5612168540cd8abe655ff85c65db5a0bb4ac132a7b113d9ffb7726f68eee489334cc35a7ae675bbf1584d7126
SSDEEP 384:n6iFiZcI63sNo8TUNTUlIm2aKMiY4wzWf/BChxMJXY5Fxsa+VY8gL/7Izno6:xFQ639wgctH4BChxMJXY5FxhgRR
TLSH
T1C9C24A36EC98CABBE8FB4FD5AB4A7A03DEE41163959C5AC4DAD81D1C008719D1307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9493bbf8-6dea-4049-98be-d373c7113d5f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9493bbf8-6dea-4049-98be-d373c7113d5f.tmp
Size 27KB
SHA256 94391d3d2431d65c8a81fa36b2d30a6b6b33cf8997da29983afeaa87e0e0470c
MD5 9fde06e73b7fbc7839533249a7e52b8e
SHA1 08b13a060990334cf09324e23dbf3116e40f4675
SHA512 e56ab5d66ca7c708fc97d4e325113e1e9f89c13bc26d4f5528ba9bb10f3ac3b9352e027bdea3a5bfb527bbc82309df48635e626926431ab7a5504b9c8171be70
SSDEEP 384:nPiFzQkUSv03sN88TUNTUlI4aaKMHCuwzWf/BChxMJXYIuDihR2IpgL/7IzwIIla:aFd031wgg8V4BChxMJXYIQi75uLc
TLSH
T163C23932EC99DA67EDEA8ED5B30A3A43DEE04223D59C9AD4D9D91C2C00CB1DD530BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

952f9158-4e56-496a-a31f-cf39dde9a1fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\952f9158-4e56-496a-a31f-cf39dde9a1fc.tmp
Size 32KB
SHA256 7b53973183f612acf19ef69e627be2806d4d740448d2df97883ced0f9fe92d85
MD5 737062da1f3993af6f1fffd8c20c5756
SHA1 498d82fba46efb3d4936aaec142b0ffdea2505f4
SHA512 0d19e044ac6d836ca17f5b0c32dfe2ca2333fa8c97c951adf8730c39a3ace2ca9cc5892fde225337e8082c24ea75360069e29fd968d895b6a8443fbedc76a4df
SSDEEP 384:nCiFzQkUSv713sN88TUNTUlI4aaKMHwuwzWf/BChxMJXYIu+mhR2IpgL/7IzwIIc:JFdZ31wggqV4BChxMJXYIXm75uLc
TLSH
T14DE2A1F298D79977D9AE4B97A33D2D0299FCC113B5989A84B7C81C1CCC861BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

0a4184df-9b4b-4ce3-86bb-e131ae6c5933.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0a4184df-9b4b-4ce3-86bb-e131ae6c5933.tmp
Size 12KB
SHA256 c017da6151524f207503be2326c25ed696b6addb5bcc39b204474b85f01817ef
MD5 a27c9963f869c9dbcf77208995973db0
SHA1 1cb6e1171dae766be1a73b77ff51fb75f3a0c88f
SHA512 7ad8a99b1a1fd7e66349c91b38cdfe3a2891f5803a34d99e6fe2fcc1c956f4af2a013a4580f0d702eaced1ac33ed2ef7d4849d8d4c6bdfec4bbf7069b126dd56
SSDEEP 192:sxZORGk0/fBsNaQZLG8CzodpVYFHW6+WNyU7/YopIMSTSIgjtPJ:sxZOP0/fBsAOh52Hbx/5SujtR
TLSH
T1D942D9556D24A97B8CC7D219BB557F53E2F9103390D58E48AAFC8A2C01E7ADD630740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13a9fa71-1cd2-4349-ab47-36587071d59c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\13a9fa71-1cd2-4349-ab47-36587071d59c.tmp
Size 12KB
SHA256 5ab58e6ccfba62f86aabf21401fe30c34911f689cafd2407fe012db31e1f3caa
MD5 c32e07616d9418d06e23cf902384032a
SHA1 8ceeb2f02db68df3d5db04f755fe3c7189671039
SHA512 0714136acfba621e49cba1c08de421880831a8283a5cb876f05e0d606e82bef0f8ef001d304014b207063b95cc254069cb0e1af0644460204875466441ce421a
SSDEEP 192:sxZORGk0/fBsMQZLG8CzodpVYFHW6+WNyU7/Yo+IMSTSIg5etPJ:sxZOP0/fBsMOh52Hbx/0SuQtR
TLSH
T1D252D856AD24A93B9CC7D219BB557F53E2F9103290D58F48AAFC8A2C05E7ADD630340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3efb399b-4228-47e1-8daa-35d74f497fb9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3efb399b-4228-47e1-8daa-35d74f497fb9.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

8f6ec0b4-a4cf-47ca-9a9d-9d8c11d7b1d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8f6ec0b4-a4cf-47ca-9a9d-9d8c11d7b1d5.tmp
Size 414B
SHA256 ab1bbc55bd53f26b380d733acc1505e4b9a0356137d31ee36e40c96d9ad212a3
MD5 bb76ca63760e5af80d57ddb27a3e7991
SHA1 38df6b222c865f02ab7545e18fc6af6797c679b3
SHA512 1d2f6c9c7287303ed9aba676405dd289274f68b1a86a3bff3a0adfae5871a76348018bb138c19836f477644872dfe5628a0f4b22f7ec8d019a050b3913eb7a26
TLSH
T18DE02B7AC821EC3B08FD0B7D60550645E71113A72A91D85B3B3D94088FB06374586C6C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000059

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000059
Size 346KB
SHA256 0f8a0722302d1b8e1050f1c7882af2c0feb056752c3feddcc0b4316891d60d44
MD5 cffe89fe76f974f10f591767becdc8ea
SHA1 63d099b0fca6062bb726f3c8bbbc704a1611182d
SHA512 69a6672dde71770eef237d7bedfb1a82317a68339abd399505acf995dc2132b0ef4e4fbd36b8453c8b9556877ba778722662b901166c77ef2c38a8d88a0a8a3d
SSDEEP 6144:kEen5NJZWrGd8LABzhu4/tZvMBhSoAxh/u0jd33ScBSNFWMI+t4A9AdHgndKrRqL:ktLWrGDdlMBhSoAxU033ScoNFWMmgnEa
TLSH
T1E774230B2E1DCA322357475B503E382845454A294BCF27921B689BE8853C9FBBEF51DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005b
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 486298187b8e087bc82398f17efb1069c7106128f3897171fe890fee91ba2706
MD5 751673dffea9ca0d7d52c60f4cc05e80
SHA1 3b3e7b1fa6b2f8b7b911f4082703c29a03d94e2b
SHA512 295b017d8cc94709fde89c683a59d2611f55007728b9c0f6eb98bfb868c33ccefab2b37db9dcc619af604e64a4770de42ddb9bf648989eb937eba5010f4b4f75
SSDEEP 96:fnqNGslFJWQlZPR+2In4XDm9+M2NSk8z+eKneP5+:fnqwsNtl22I4Xs+xQ0nL
TLSH
T1CC916382AB983370F7DC4071D9B61FB737A0478A78CB0D55E968DBB51403394B1A527C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef34d7d8-5e19-4948-a7f6-e19b8e11a684.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ef34d7d8-5e19-4948-a7f6-e19b8e11a684.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2d3ef208-7a7a-4b1b-8ba4-748fdc532a8e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2d3ef208-7a7a-4b1b-8ba4-748fdc532a8e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

93c8d969-a3ef-4c03-8d20-31843a49facf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\93c8d969-a3ef-4c03-8d20-31843a49facf.tmp
Size 7KB
SHA256 a0aec4e8fe6e4d55482b09f160180b8797d1c399f88cd0eb95bd8d964b213d64
MD5 30b7f4904f273c48d369372b8fdf37ef
SHA1 47ac26c42bf94d375b679ccd1adde35ca2ad5bec
SHA512 a39e38e4a36093e50558649bea39f7ab809e6ae995594629cf789e10d9f8cc7d349fc932229a54611fa76ca26c2a05823d89648ef2c5433185bc62e67ed93469
SSDEEP 192:D1Jl8UYTjoWyDCI518GaamoFuPNByqCqXiRKCWc:D1Jlb2joWyDB518GaamoFuPNByqCqXij
TLSH
T1F6E188F7C7D8822DC81156F49715BF1ECE2D0A18432C3C6AC8D8AE6B93E2431E25575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab241bba-4403-4cb5-97f4-ec22ab571b66.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ab241bba-4403-4cb5-97f4-ec22ab571b66.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 20e5f09d305db86e4b0763709fe7911261cb4560f6ca639faef9954cd7b56beb
MD5 d4d2411cc6040562a2387ee817263089
SHA1 eaa7379c8360cad52394af48083e58094083e4a7
SHA512 fb88dc44ec99f73f7d8e8791b8c2d850149361cadd85eb8a2020c2b7faef9704f00b833b9c87a93230a2949e33692bcf27eae071f54be86282d61c018b81299b
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgM:ST/2dXOJhJlpfnpp3tNXVrN3ojDAxBs
TLSH
T13DC22F5571BB421039FE291C92B58B6E064231B33119E66B7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

e049651f-41f3-497c-bfc2-596af99e4df2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e049651f-41f3-497c-bfc2-596af99e4df2.tmp
Size 12KB
SHA256 2328f217d2f9c23845e20e1347cf296714c7df3a242565ea7693af1ebbde6a09
MD5 ef5a3f34c8ed1e48291ba2f09c6b398d
SHA1 56193736a483b2df42e2e87afea112c2e0afa502
SHA512 9c3ff085ef6dc0661cb0bb4af752cf59a290b466a35f6bfaf3ad995e51269c95441dfa962bcd8abad758f02f9498b21edfda3687e2885d8e2cd50cc3c8184061
SSDEEP 192:sxZORGk0/fBsRaQZLG8CzodpVYFHW6+WNyU7/YopIMSTSIg5etPJ:sxZOP0/fBsEOh52Hbx/5SuQtR
TLSH
T1D752D856AD24A97B8CC7D219BB557F53E2F9103290D58E48EAFC8A2C01E7ADD630340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e46838d8-cf7b-4867-8bdc-e2f82aa3abd8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e46838d8-cf7b-4867-8bdc-e2f82aa3abd8.tmp
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c477242b-5f75-41a8-9423-c08b775ad8b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c477242b-5f75-41a8-9423-c08b775ad8b5.tmp
Size 27KB
SHA256 610fb32a464ac036c17a93907ebb73216dfc00f83c3b6a37aa69969c5516368c
MD5 88fe060429321a183531e3dc37fe4870
SHA1 a64c0c28abb60d21dbdcea548df8a664f96ba8a8
SHA512 a5eff4cc3268ba74894fb5dd31df24716af3662b9d8298255315a4501e73c25b32460825076c83b95b2f77daa6a197667357cf7ad7c7711b5427ffd05a235105
SSDEEP 384:nAiFzQkUSv03sN88TUNTUlI4aaKMhbCuwzWf/BChxMJXYIuDihR2IpgL/7IzwIIc:bFd031wgg2V4BChxMJXYIQi75uLc
TLSH
T13AC23932EC99DA67EDEA8ED5A30A3A43DEE04213D59C9AD4D9C91C2C00CB1DD530BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 134293c6acc84ac76016d6ab2c4482adf269ac97df36c27e99122952eedff76b
MD5 18a7c15c4adf284318700fc122f94ba1
SHA1 b594657b67dece63a2a407981a7efb87776e1120
SHA512 1b92fcaff0d901b7972c23867bfd0fba60aee1fb82c24d24d96e599489b8e7668b50ac2016beefcc5eee03ce95be2e92f9d9cbb9ed7f538d8d1bb352ec1f1700
TLSH
T1F6412D58A6E91148B3B77E5A5FF7E86E487E78772E16D45D10110E4F0627A00CCB2B37
MD5 SHA1 SHA512 TLSH

Submit Download