hxxps://share[.]google/s02BjsokyJMF0AaAn

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://share.google/s02BjsokyJMF0AaAn
Sample260805-e8vfbsde57

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3716	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303782427800498"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{B70463AF-0423-42E9-BE67-BFED25B592E3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1112	msedge.exe
1112	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 2576	4456	msedge.exe	86
PID 4456 wrote to memory of 3716	4456	msedge.exe	87
PID 4456 wrote to memory of 3744	4456	msedge.exe	88
PID 4456 wrote to memory of 3744	4456	msedge.exe	88
PID 4456 wrote to memory of 3744	4456	msedge.exe	88
PID 4456 wrote to memory of 4668	4456	msedge.exe	89
PID 4456 wrote to memory of 4668	4456	msedge.exe	89
PID 4456 wrote to memory of 2352	4456	msedge.exe	90
PID 4456 wrote to memory of 2696	4456	msedge.exe	91
PID 4456 wrote to memory of 2352	4456	msedge.exe	90
PID 4456 wrote to memory of 2352	4456	msedge.exe	90
PID 4456 wrote to memory of 2696	4456	msedge.exe	91
PID 4456 wrote to memory of 2696	4456	msedge.exe	91
PID 4456 wrote to memory of 1544	4456	msedge.exe	92
PID 4456 wrote to memory of 1544	4456	msedge.exe	92
PID 4456 wrote to memory of 1544	4456	msedge.exe	92
PID 4456 wrote to memory of 2316	4456	msedge.exe	93
PID 4456 wrote to memory of 2316	4456	msedge.exe	93
PID 4456 wrote to memory of 2316	4456	msedge.exe	93
PID 4456 wrote to memory of 3832	4456	msedge.exe	99
PID 4456 wrote to memory of 3832	4456	msedge.exe	99
PID 4456 wrote to memory of 2480	4456	msedge.exe	100
PID 4456 wrote to memory of 2480	4456	msedge.exe	100
PID 4456 wrote to memory of 1376	4456	msedge.exe	102
PID 4456 wrote to memory of 3048	4456	msedge.exe	103
PID 4456 wrote to memory of 3048	4456	msedge.exe	103
PID 4456 wrote to memory of 3048	4456	msedge.exe	103
PID 4456 wrote to memory of 400	4456	msedge.exe	107
PID 4456 wrote to memory of 4076	4456	msedge.exe	108
PID 4456 wrote to memory of 4108	4456	msedge.exe	109
PID 4456 wrote to memory of 2332	4456	msedge.exe	110
PID 4456 wrote to memory of 2332	4456	msedge.exe	110
PID 4456 wrote to memory of 3748	4456	msedge.exe	118
PID 4456 wrote to memory of 3748	4456	msedge.exe	118
PID 4456 wrote to memory of 4172	4456	msedge.exe	119
PID 4456 wrote to memory of 4172	4456	msedge.exe	119
PID 4456 wrote to memory of 1112	4456	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://share.google/s02BjsokyJMF0AaAn
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffcb753c188,0x7ffcb753c194,0x7ffcb753c1a0
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,11099153160198457284,2013285822042372514,524288 --field-trial-handle=2296,i,14490106113862472814,5056235111576491622,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,16707110799444042549,3615881190943631550,262144 --field-trial-handle=2296,i,14490106113862472814,5056235111576491622,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,5541441609931616642,6827271634432698769,524288 --field-trial-handle=2296,i,14490106113862472814,5056235111576491622,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,9861467048718599662,8952835453747794907,2097152 --field-trial-handle=2296,i,14490106113862472814,5056235111576491622,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,12659401400137842542,6791256525689816937,2097152 --field-trial-handle=2296,i,14490106113862472814,5056235111576491622,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,12115469255468178062,9033356662689748353,2097152 --field-trial-handle=2296,i,14490106113862472814,5056235111576491622,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4160,i,12647582012921732138,2604186594157623030,2097152 --field-trial-handle=2296,i,14490106113862472814,5056235111576491622,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:2
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,8125661683866309455,2315411722860780439,524288 --field-trial-handle=2296,i,14490106113862472814,5056235111576491622,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,16925059025134920421,11566234968238932981,524288 --field-trial-handle=2296,i,14490106113862472814,5056235111576491622,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,8726601222982732539,16687745881653807906,524288 --field-trial-handle=2296,i,14490106113862472814,5056235111576491622,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,8726601222982732539,16687745881653807906,524288 --field-trial-handle=2296,i,14490106113862472814,5056235111576491622,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4192,i,1181273080382297509,13511960442388338387,2097152 --field-trial-handle=2296,i,14490106113862472814,5056235111576491622,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,16721173543433287549,11424995822269181668,524288 --field-trial-handle=2296,i,14490106113862472814,5056235111576491622,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,485568436541068685,12859706475240157105,524288 --field-trial-handle=2296,i,14490106113862472814,5056235111576491622,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,15479804779679702835,10521477611203619293,524288 --field-trial-handle=2296,i,14490106113862472814,5056235111576491622,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,5907754409116402854,7878717844383547436,524288 --field-trial-handle=2296,i,14490106113862472814,5056235111576491622,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:8
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,1518362436344696371,1890189020693616325,524288 --field-trial-handle=2296,i,14490106113862472814,5056235111576491622,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,18125011913182224282,2593956513569767606,524288 --field-trial-handle=2296,i,14490106113862472814,5056235111576491622,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6476,i,8937191123952640707,16335122450050707133,262144 --field-trial-handle=2296,i,14490106113862472814,5056235111576491622,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 537B
SHA256 402bb8199cc05cd7603bc85e24ddb39064182f08cbe1b7acb6d7a678e58acb66
MD5 4b1007996ead1b65ca9a5658e2159a0c
SHA1 e82f73b8ad9bac68488d40f58111ed119f3729f1
SHA512 359598a63a8bc7f7cd3b1fd41e88955dec76d8d8ca9411c683a86da11f9f237dd525bfc79a0f2508b19e55a26f262e67807ec1103bd2cb227709324d8a77d9f2
TLSH
T17FF08BA89FC5C72EAB1075C74374830C41C0370ADFC8FA0A1B1449887106555B6EAFE1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 44d1f06db968e55a2114a6e28b80c414638f3635af5eb9801eccc0622842f119
MD5 05fbc2fa121993375bebf7df3133dcdc
SHA1 e7a80ea6646741d4c5f389a5b944607d71531055
SHA512 70ce7077726d9a3d3312b5dd6c77889bea4287a74139c9243d37efafe59a6177075d04f7837f4f6e25d6a7f2aa127080a4b44889d4d1c5d0dd660e86bc346db7
TLSH
T11461E5BE0596EDF6E3D13A3190C03A8738F190E8FD63FD5D02E348B5640AB118A6A4CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588ae6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588ae6.TMP
Size 3KB
SHA256 efa515765c425619fb7fad68aa5666d6e12f1a1de13baf9ce5a30afdad89eaf4
MD5 8c8d346c1494a264727b351e557795b6
SHA1 44f8911f9d9422b86f64d985996ad8bd2f07fc47
SHA512 900aeb8ab77991d68b548cd9920bd60117fcca7f8ad598f6814b2df404a8a06e791c411574a997cf627c7b99c4632829cddaae643c40b0857c20c504652d723e
TLSH
T19C61C3BE0582EDF6E3D13A3190C03A8738F290E8F823BD5D01E748B9641AB114A6A4CD
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 131e5dbe5525a708700f8420fd0035e7d7c4318638531db95c2efbdf53343822
MD5 849c3c84b244552484c1e97908a3cd5d
SHA1 b2e32b64fc3f100ea20578bbb17b0ae932dbe820
SHA512 0d0f34780bed53f017aba155ca3e9cd513996a2d4e8bb1132c0d9acafd8a95f7f67601046164aaa440288e742b88057a7953564c77541f2259111fdcb1a0ea12
TLSH
T19851AFF7C3E8861DCC2157F0AB24AE1BCE2D0A1842283C66C9D5EF5B93E2871E10154F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 495a69e57c4fb241c9b5ab6c68b225ce204b236d5f84ef377fd5c592e106cf17
MD5 326517955a1ec99786e2ed4f0458773d
SHA1 8fb4176cf73a0d2bd6125948a8aebfc2a9883977
SHA512 418eae1dd6c9c4c2c3768636e9216258b870414880ab432c33709d078b9636cf3e001e477dc1d5a54dde2f781a4b0d5c229318d7b1f30c1483e41a6aece2b310
SSDEEP 192:sxZtR/yM/jK1Ml8Mk9/fas+CLhPzIdpJHW6+WNGY9IoCGeIgrJ:sxZt3M9/fas+WhkJHbG79
TLSH
T1B242E7126A34A977CCCBD309FA55BF43D6F91572A2900E54A9FCDA0C01E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 63516513dec3a96d5267d4bb40731ae16b6a661c8fb24609b0938f1f47343dea
MD5 b994b6a2088b545afc5c53b8276f4650
SHA1 6ce89ed0226c2f815d0b13425fa158b4642eb910
SHA512 682f0b8e290cf351ad322473fb1582d64a63b4384dbc6c68fc5711bb2fe1fdea2e565cfa5e9a4957f788cff29cd641e4eb1a349794d06813c8d9eb2d5ebc3ddb
SSDEEP 192:sxZtR/yM/jK1Ml8UQ6k9/fashCLR2zIdpB0HW6+WN4B+XY9IRhGeIg5BJ:sxZthqJ9/fashWR7iHbHXbN
TLSH
T1C452D6126A349977CCDBD309F955BF53D6F9147292900E94AAFCDA1C01E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a6b2f186dcf8c3971388f47cf3f0191e8222a44f40341f4a566e673a84a80b62
MD5 1f3ce663a4b754ffc9060bce51e0a8bc
SHA1 d783b4996f0fe8607436984b3c76309c9ab4c4df
SHA512 b75302b2e8b9fea359ea746bfb0de9e693ecf2594ea60e18e0d2ef4e305a7d1c07adb07f1e45536a8a692622ae14028a19027a035b235c1dde4ba25c9c852f49
SSDEEP 192:sxZtR/yM/jK1Ml8Mk9/fashCLR2zIdpj0HW6+WN4C5/Y9I76GeIg5BJ:sxZthM9/fashWR7AHbj/yN
TLSH
T14952D6126A34A977CCDBD309FA54BF53D6F9147292900E549AFCDA1C01E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b0233a41dbf83a2f2978cb0ffbbea87a9796c82c3cd52761e66395e1bd23e44f
MD5 915e1a622834e8b3f6b193fce211c4a5
SHA1 4d0b9f16b74ce174f52d236295459ffef8d64577
SHA512 c321a9c497611632f292bbcf808db83d32fd36b46b823d297e9ef32738c0fdf4cfaa429a02ae3dd5485c5047e3268d4f5c65cc1e1e026b432c4337892533497f
SSDEEP 768:Lkcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNkromg6D:Lkcv21wWvu+Z+u1jaeFLeRNvmz
TLSH
T17AD20B2B280CCB7E4F845E9CED2A6F8A6DD801CB57988D5447FA884C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b0d6369be6df75f3755c5906dd7798ea039b6bacec5f2175c8419c7ee218c8cd
MD5 2f7e427f7c4139984bd54f65ce6d03cd
SHA1 71255a238a6fe621bd592d7c6d8718fd3dc7d39e
SHA512 ed509a2f946d1ac0605f90e1fe6d0a9d187a7ecd3deef9100abefd8b0d859e3c15683269c1526d78d656237e5b609e227a4c3a2d7e9296ae1c6e366c734f8b33
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDCygKTyaqeAKr6WU:mTfHfbU
TLSH
T14F91C555317E02D23C3E285C9A6589265E423563740AEA7FBBB901920F67E226CFDCDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2badf810-4851-406b-9508-ffc63f9f990d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2badf810-4851-406b-9508-ffc63f9f990d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 69bdbae1593e75bcbe4f882a2f808073a4a8a88bd097c9dda59584e8248180f7
MD5 ae22f41eb05182497bc8bcf85f5e4f73
SHA1 22e317918c8418e9518820daffcca8d2e8318a38
SHA512 c81c1c5f56e94548643fbd7aeef2d66daa246287e5977419b57a30375a3689f06e7b040b714b0db97e22a3e35d46393a1cd4c3fdfb71886300c9b985acb2b060
SSDEEP 192:uxLsNaxQwpSZxkih+YLeqxQmiU1lnw4e+CG6Om9opwSJrHKvJi/bqrk3r8:usNaxqziof/e+CXOmep3Jr3/gk3r8
TLSH
T14C422935AD385C775EE3A691F48A36139EB850ABD6852FD0D6DC6F1C02DF29C230AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 634b481bbcdd02794d12adb01d728df957f2e2c8c58c723a784b3da618172c57
MD5 d705a83564822a8cf5080c4535647eb8
SHA1 e4f8261f6385ef9f1667d0bb208c8bea8cc95cf5
SHA512 747c2c1a5e60a7938992be03f7da8b8387fd7b86eb2689f89a9c00335825dd654cd2aa06f69c9636fe0a1699219969a3776c41108e8384a65993564bdea214d3
SSDEEP 192:JONO6v+YLNQmiUyQFZh+CG6Om9oEusolU6:JONO6vz/bZh+CXOme60U6
TLSH
T13202E935BD281C6B9FF26E45F98737275FA9217BE9952F80D9E82E0C01D764C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d00c1e79e92c3228177353dd608e186ae838e7f4aa26b2470e84956b49cc71ef
MD5 7dfc9b233f29e231d8bea27af7ce0be7
SHA1 1c358380fc1e26b44fb31c6d7d9f71d4f1546c69
SHA512 49c08b9c76e21d975f1b51f8b652c05b9f66451b5d9fd57efeedb3d8823fd5a4a28e77b15076654126017c7d64593a57eb809cdbab52069aacf5e9bfc9c53cd7
SSDEEP 384:miFgzsN58TUNTUlIl0qzioc/e+CXOmep3Jrm/gk3rj:NF8qwgrymvO9p3hm/gk3rj
TLSH
T19792C5F258E74836D9AE5743E77D2D038EBCD0A7B5816A90B788590CCD9B1BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 6596375f468cf04e56786ec8512e88a90f1b7fa0e7458e6da24e823739942cab
MD5 3ed6039fa751dec23155c21c778fe2fe
SHA1 f48dab2a0a67f4c182600275937e4f3726a2c28b
SHA512 38aee575747e0d47c575b533e64c5fe532be824b30a47b7d5853c29f2f687fa0c719c3940b0663de1aca93b99151fcecae6b7eff569b72dac8d7846e4a98d15e
SSDEEP 384:miFgzsNi8TUNTUlIl0qzioc/e+CXOmep3Jrk/gk3rj:NF8rwgrymvO9p3hk/gk3rj
TLSH
T1AA92C5F258E78836D9AE5B43E77D2D038EBCD0A7B5416A90B388590CCD9B1BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 503f1e36a42282784cd12fa3550b522e9f15e1685f38a9b03929414d33ef57a0
MD5 e5cf46e7e49965e73fc1633f74705765
SHA1 ca0618be53a3008959a184e0eb7c70be2550b522
SHA512 ab37773420711e663ed1a7e6f495fccf2d776cbc5eedfee3c4b659d0aa73ababec1e05c8f420e120ce0da8e833f4df5d203a1213c823283c35e4f3681f599c65
SSDEEP 192:u1LsNa0QwpSZxkih+YLeqxQmiU1lnw4e+CG6Om9opwSJrHKvJi/bqrk3rj:OsNa0qziof/e+CXOmep3Jr3/gk3rj
TLSH
T1E152193568385C775EE3A691F48A36139EB860ABD6852FD0D6DC6F1C02DF69C230AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 440365eb6aefb0547fdb5eee07806d646821c22159ef1c4550f123c40ea983b4
MD5 0d67469609b985b1b48eebf979be1aba
SHA1 e3f42e570e6049ffe96799cd0b13bb556102005f
SHA512 0f68e5272ec5f0a937ecc07872fd3580b01bba4ec22038c3949f6b37b12ee41ec85db0115441db2b1a92d87f2ccc6692ce7a03c9273fefc8130672fa1ee2df7f
SSDEEP 192:HOND6v+YLaQmiUyrFdh+CG6Om9opwSJrHhCH/bqrU6:HOND6vzSydh+CXOmep3JrG/gU6
TLSH
T16F122B35B9385C7B5EE26591F48736139EA86167EA863FC0D5DC3E1C02EF65C230A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bf156b78b0ef0b4c3f87665ba9c11b8c98e2d3ca801f605ce3dfc06c2514dcc0
MD5 d68249e758c72c260532da5e5d826879
SHA1 b61e7a3b6f57eaebc9132107ca357425af7e4fff
SHA512 5b20246dec04695537547178cb450649b5eb24cf8b30a544c9693771c0715747f9de95a466d6caaaf2ee0f06336416c1760ba23f553d492bcf84d4f555165500
TLSH
T194412958A6E91148B3776F569BF6A46E887B79772F0AD49E10010E4F0A62B00CD71B73
MD5 SHA1 SHA512 TLSH

Submit Download