hxxps://support[.]google[.]com/calendar/answer/37135#forwarding

Analysis

user interaction
yes
max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://support.google.com/calendar/answer/37135#forwarding
Sample260924-e7jbnsyfpc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4884	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134346981031093954"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{DE0E8AA6-29CA-4D4F-B90A-015E3063DA13}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 960	4100	msedge.exe	86
PID 4100 wrote to memory of 3324	4100	msedge.exe	87
PID 4100 wrote to memory of 4884	4100	msedge.exe	88
PID 4100 wrote to memory of 3324	4100	msedge.exe	87
PID 4100 wrote to memory of 3324	4100	msedge.exe	87
PID 4100 wrote to memory of 2008	4100	msedge.exe	90
PID 4100 wrote to memory of 2008	4100	msedge.exe	90
PID 4100 wrote to memory of 2356	4100	msedge.exe	91
PID 4100 wrote to memory of 2016	4100	msedge.exe	92
PID 4100 wrote to memory of 2356	4100	msedge.exe	91
PID 4100 wrote to memory of 2356	4100	msedge.exe	91
PID 4100 wrote to memory of 2016	4100	msedge.exe	92
PID 4100 wrote to memory of 2016	4100	msedge.exe	92
PID 4100 wrote to memory of 1004	4100	msedge.exe	93
PID 4100 wrote to memory of 1004	4100	msedge.exe	93
PID 4100 wrote to memory of 1004	4100	msedge.exe	93
PID 4100 wrote to memory of 4864	4100	msedge.exe	94
PID 4100 wrote to memory of 4864	4100	msedge.exe	94
PID 4100 wrote to memory of 4864	4100	msedge.exe	94
PID 4100 wrote to memory of 3144	4100	msedge.exe	99
PID 4100 wrote to memory of 4108	4100	msedge.exe	98
PID 4100 wrote to memory of 3144	4100	msedge.exe	99
PID 4100 wrote to memory of 4108	4100	msedge.exe	98
PID 4100 wrote to memory of 3264	4100	msedge.exe	101
PID 4100 wrote to memory of 5108	4100	msedge.exe	116
PID 4100 wrote to memory of 4556	4100	msedge.exe	117
PID 4100 wrote to memory of 1176	4100	msedge.exe	118
PID 4100 wrote to memory of 616	4100	msedge.exe	127
PID 4100 wrote to memory of 616	4100	msedge.exe	127
PID 4100 wrote to memory of 4604	4100	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://support.google.com/calendar/answer/37135#forwarding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffab7c2c188,0x7ffab7c2c194,0x7ffab7c2c1a0
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1912,i,12009077735216463857,6674119567079224194,262144 --field-trial-handle=2032,i,12203738680836734167,9895393394839744655,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2072,i,3534977525338771620,7452075922394299367,524288 --field-trial-handle=2032,i,12203738680836734167,9895393394839744655,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,1585963247332412166,17810943771171890793,524288 --field-trial-handle=2032,i,12203738680836734167,9895393394839744655,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,8675236704229473769,2484188462667886857,2097152 --field-trial-handle=2032,i,12203738680836734167,9895393394839744655,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,17363943525527334641,7552165483333064896,2097152 --field-trial-handle=2032,i,12203738680836734167,9895393394839744655,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,13476271993527446293,12657481627507481695,2097152 --field-trial-handle=2032,i,12203738680836734167,9895393394839744655,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,13553193834798262690,14673041018961143957,2097152 --field-trial-handle=2032,i,12203738680836734167,9895393394839744655,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,8268605203680833550,11996376843122790227,524288 --field-trial-handle=2032,i,12203738680836734167,9895393394839744655,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,16185782472784509925,18177830603513333701,524288 --field-trial-handle=2032,i,12203738680836734167,9895393394839744655,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,7358989090762903650,2284180509730952065,524288 --field-trial-handle=2032,i,12203738680836734167,9895393394839744655,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,7358989090762903650,2284180509730952065,524288 --field-trial-handle=2032,i,12203738680836734167,9895393394839744655,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,2275325509655441513,14967752609048343051,524288 --field-trial-handle=2032,i,12203738680836734167,9895393394839744655,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,14295530472289107304,5687066363256490793,524288 --field-trial-handle=2032,i,12203738680836734167,9895393394839744655,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,3126230277407009479,10127601189259335584,524288 --field-trial-handle=2032,i,12203738680836734167,9895393394839744655,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,4428393686969545868,17328256687100980383,524288 --field-trial-handle=2032,i,12203738680836734167,9895393394839744655,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=756,i,9449179340671820585,6846142207572939792,262144 --field-trial-handle=2032,i,12203738680836734167,9895393394839744655,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ad9341a3ad2b263d2be4ffd8a97b10f49a2c167d02a5b66182496dee5e8cf827
MD5 8f79499bd1d234dc030ef99e2f850e0e
SHA1 4dd7c44b8570ce93f3db7df7fe1188f189fa82fa
SHA512 d06aa3eb27c999ba47fce9a170740591ef6bacf188a5d364ad9a567936919e24290b5c0c3a8ad16cae1e37c71c2364d9db3ba42e5914a96b0f1f732c29ff5945
TLSH
T199D022F83BC00800C8C830F3303ACB8003B2EB208202230E20F20E080C303F23202880
MD5 SHA1 SHA512 TLSH

Submit Download

74165421-82b6-438c-90a3-96f13599d43b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\74165421-82b6-438c-90a3-96f13599d43b.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9b12bec1560e40dca02ec8d84ccf183e61504ee83429e4e1dd415061443db427
MD5 97fe370fc3b8ac7d4a811601013f32cb
SHA1 16a591bcb1cfe353f68faf0599b265c909cb0cc3
SHA512 93bb46be807c81dcc3ae2ea1be97a1184634efc96c4c929f863268018e49edc1d8c292ad961bfd6127563a4200410655650e5c19ae6394df0dd0b59d10047d28
TLSH
T153616FB1344F8D67EFA8557C99F5208B3A3C3DF444832D4E89B4F8EA43AA756904080B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c59d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c59d.TMP
Size 3KB
SHA256 c80f07181450176fdb474b78d7ed4eb7709c2356e6e9d43493afe3e0d1e55ef8
MD5 32c96aa6e3ba521398d600121c827102
SHA1 714b3562ab8f8dfa9910d925bad040183e47c438
SHA512 b3b47cc1145643677287799b55cef587aec71932a8530286a217adbdbc91865a1795334f53e88d5acc41c74bf64870a13e7c7c546afe54f66817be4cfee10d52
TLSH
T17C615EB1344F8D57EFA855BC99F4108B3A3C7DF041832E4F89B4F8EA47AA3569040847
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 a243c164c0db3da154b4a2366cadbb2f4fd8d512ea0bb874a6e740ed76ff99e8
MD5 a11ab0e19b700c16352d28e663ca89d9
SHA1 430fdc79a21119ac036e14aa1c59ef30317b40b4
SHA512 4a5b8b91a7d878d0639afa2e790e4915966c78a9f952c0b39e48cec2ccc04ad3bda338cba019ddc235a9feb37c78d1080f0d2decc3924876b3ee1b75408c983f
SSDEEP 96:D3O1HfyO7l7v9Iz7yBpXtQiwMcWkg1b4Sgcx0RSmwQ:De1HfyO7l7v9I/yBpXthwjWkg1b4Sg+i
TLSH
T1B0B1AEF7C3D9862DC81196F8AB15AF2BCF1D0A18432C3D6684D8AF5B93E2472D21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 a317ea18f2d99ee396d170373a42f8568527ec3b72077f8754a42775c4dcf83f
MD5 3679188dc3522546ae72969b54f84704
SHA1 8b21d1c4c81cd736411313aa5b59af590ac32ade
SHA512 6c43c844a1313a446029792dbf3824785eeed29dea2cea724a2f58d8d830f63125d14ee3590112c94f5dae309c4056bc199b84a7baef6884b00a146727dc9a4e
SSDEEP 192:sxZLRnWJZ/fRsqVpOqIdp7sHW6+WNA0e9/YRPZIiIgrJ:sxZL0JZ/fRsupOjwHbAX/mB9
TLSH
T19522C7566E38A97B8CC7E60DBA25BF53D6F9503291D01E48AAFC861C14E7ADD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3bdc860cf4e1b251937fddce933dc38a8df66c14fefa39295eb21d33c954c5fe
MD5 b54998db049d69981dd05409f694d1a8
SHA1 b6103f2b21dce58ee99a5aaea902306c0e88a98a
SHA512 6db397987b467675b6f94a0065f8dc92df9918ea208c4f9c778143174f69af3532fff8a76a17c945e118c32e5c051dd7bc66aabb895a92c094a3e2476a8a2cfe
SSDEEP 192:sxZLRnWJZ/fRsvlVpOqIdppsHW6+WNA0e9/YRP/IiIg5rJ:sxZL0JZ/fRsvPpOjeHbAX/m7D
TLSH
T17822E8566E38A97B8CC7E60DBA15BF53E6F9403291D01E48AAFC871C15E7ACD130781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2bc2169f4129200d3616da3b5d70383cf7620f171f467ca7238b2055bc4d5a44
MD5 5bbe2f4a47a4cb3baf334793436a9720
SHA1 a4e507959247cbea1aacdc8ec9eb5614efa47032
SHA512 16b21045b559614843e6fbfe4c4cf64ddb95fb23d0cde5794943d00195323f17e01ca13f8cd76ebf2b45afeb8d5084ea6be5f552a2fb4c84aef7ed1d6dc09a27
SSDEEP 192:sxZLRnWJZ/fRsvlVpOqIdp7sHW6+WNA0e9/YRP1IiIg5rJ:sxZL0JZ/fRsvPpOjwHbAX/mdD
TLSH
T1F122E8566E38A97B8CC7E60DBA15BF53E6F9403291D01E48A6FC871C15E7ACD230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0af229e8d46fd310ad011898091b82b7999895dffa8483dfd900e7ff92df262a
MD5 e7ff268879a321c37efa0d7b6d6ddccd
SHA1 33f0fa3958230eb1bf43987efdc1267f50a45e30
SHA512 4d12545696e4e086240abe42e18301b45d484a6007fea2b4b6f6df71f8bff4b821400a840be0cf87cb35b23a88990a6c3e957ad091acbe25921592b778a2dc4d
SSDEEP 192:sxZLRnWJZ/fRsveVpOqIdp7sHW6+WNA0e9/YRPZIiIg5xJ:sxZL0JZ/fRsvKpOjwHbAX/mBN
TLSH
T10E22D7566E38A97B8CC7D60DBA15BF53D6F9403291D01E48AAFC861C14E7ADD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 46172483533b0d4da44f4d70f40b21b37791739d1725b42f7ce3c630f80b6983
MD5 a970d61203f808ae257df0722c162479
SHA1 fbf3f23d89c78e15bb483ea948d2105027a3a869
SHA512 51f6cc9f2d400b4bdac2264824cf77932ff6fdb31b7c4f6a9a1b1660d1d6dcbb0fbc7f58a08de831313f9903862e6838ae7fc82714697b44974049ee4490f9bb
SSDEEP 768:N9K9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3Srok+YN:N9K9uzYWvcQWsu1ja0HL7Q3Jk+YN
TLSH
T167C2F93F640DCB7E4FC01A9DDC5A6F972E9802D7A6588D4047FA984C02C77EA52264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5959ce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5959ce.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f4c26d85490890c2571b532dc71e0502211ee311bb26994fa2229a4659dba658
MD5 55deac08a3cab25bc0262d6111456ea1
SHA1 e9cd98a8bf1399e33063cc99d99d654337836e16
SHA512 9e218acbf2f83528e27a33fa9c2a90781db46ee339077e587ef679f5271859f8d8ab19f86df83275c2b8a43d781a85cf99ff8402a42c8b7bfb5db05beaad656e
SSDEEP 384:1ZcIhsNgCGtwHE0ivFuOjTVINOrnjla0/upa7dLKksQaoY:NhTDnWO7jla0Sa7dLKksQan
TLSH
T140828E716C785C775CBAA185F84B36038FF880A7D6496F84E4DD5F1D06DA6AC230BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a1093ac3938ea05c2fc307fc4220881835ade32e7471bbc6569e4567693b7758
MD5 74774e2e02f632a53c0893b59f7d3fab
SHA1 35bcb292491dba65c3df8712dd00b60c8027d3ba
SHA512 4f7676634855b07a39a0196efca3de04e95a4d3301c212bbc18b9e9b4e7d5e369782ce89f85ef1bceffbf63b1bc06e456eed920e5aa38a4fc501608851bfd28d
SSDEEP 384:HiFiZcIYzsNg8TUNTUlIltGtwHE0iVFuOjTVINOrnj5a0/upa7dLKksQaoY:CFQk9wg8DnWO7j5a0Sa7dLKksQan
TLSH
T155C229F248E74876D8AE5747A73D2D038EBCC0A7B445AA80B3DC5A0DCD961BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d53edd26e646e7c6f3a48961e68d05c7f7542915ac10f22f3e6113ee43cd7c18
MD5 3746183282e8881eb6b5046bda48052a
SHA1 2e115d2bba84002c9c57e722492d44b9cad758f9
SHA512 e42522f010851a6082fec24b9fbc780b503b7650fe16171624aef02cd21b7a466a97b64b44d66d5017163bc1bf248f20c85639c734b0e0c12f61b986a87a663e
SSDEEP 192:SONu6ygpQmiUy8ItOCTVg3NOqm5zP0uU6:SONu6lH2tOCTVINO9jU6
TLSH
T1F602D634AC683CB78DB2AE45F58727139FA8106BDA562F84DAE81F1C01D779C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6dbafee4e31cd316642d9fdf62f4495dfa34bb0bedc1d1e014514b41f7141142
MD5 4a1b2d48c99e2730cd8bcedbd51a95bc
SHA1 022e590355ba367badcaabe0c70e053c478e53be
SHA512 4ae9a78d124f6f06a68fdf7e45e40d3cc910deebaf8cdef78e306798dee19e55c9451b6f0f6a54d176804b0fd1865832ab48431f0b8192f011dee56d3818d3a0
SSDEEP 384:AZcIhsNgtGtwHE0ivFuOjTVINOrnjla0/upa7dLKksQaoY:+hQDnWO7jla0Sa7dLKksQan
TLSH
T13A828E716C785C775CBAA185F44B36038FF88067D6496F84E4ED5F1E06DAAAC230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8b6e3fea1723878f7c2188a6399b4c0f089c468fc5d8d17340ac6822400d8f64
MD5 0c345a2098adb46103977c4f4d79f554
SHA1 2dc63048d4a5cb45c02ec5f5dadf8f8b3cb08834
SHA512 cf97f2414a8ebbab70f3021fb0774b16839a402eb97c0c9012b73d861e4ee865c5ac96a84223f6f3d49d21f056e3c7de14028f5c071f78c6465a702f5e715ca2
SSDEEP 192:SONJ6y+QmiUyEIwOCTVg3NOqmjnjOebl3UM/jU6:SONJ6lgwOCTVINOrnjoaU6
TLSH
T1DE123B35BD786C775DA26585F48B32039EA44167DA4A3F80E5DD2F1C01EFAAC230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

12336112-d209-4264-a139-5bcc4a097777.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\12336112-d209-4264-a139-5bcc4a097777.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7ab4047b994f0080d1e2e6901f7622d24fcd548a7ce37ee396c1a3304f0c87dc
MD5 b3851a9b1680089f0939a5012c4045ba
SHA1 a0271620123eaa8a7880a717d3289c4a2485adf9
SHA512 45812beddba0c4df57835f2b8b3afbec3032c5697e4e63ed4816a53d7334281f5259e4b5f7af93407697d5e50eff590876b77593bc95d2d05e31392c39004137
TLSH
T1E1412A58ABFA1154B3B77E469BF6A46D44BBB9372F46D46D00010D4F0A33A41C961B37
MD5 SHA1 SHA512 TLSH

Submit Download