hxxps://share[.]google/MddzQhJ6Mb6pEtFcC

Analysis

user interaction
yes
max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://share.google/MddzQhJ6Mb6pEtFcC
Sample260930-pskw3afe35

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3204	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{A268D609-4FD3-40F2-8CDE-092D97C05367}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 4388	540	msedge.exe	84
PID 540 wrote to memory of 3204	540	msedge.exe	85
PID 540 wrote to memory of 1840	540	msedge.exe	86
PID 540 wrote to memory of 1840	540	msedge.exe	86
PID 540 wrote to memory of 1840	540	msedge.exe	86
PID 540 wrote to memory of 4080	540	msedge.exe	87
PID 540 wrote to memory of 4080	540	msedge.exe	87
PID 540 wrote to memory of 924	540	msedge.exe	89
PID 540 wrote to memory of 924	540	msedge.exe	89
PID 540 wrote to memory of 924	540	msedge.exe	89
PID 540 wrote to memory of 5052	540	msedge.exe	90
PID 540 wrote to memory of 5052	540	msedge.exe	90
PID 540 wrote to memory of 5052	540	msedge.exe	90
PID 540 wrote to memory of 1236	540	msedge.exe	91
PID 540 wrote to memory of 2084	540	msedge.exe	92
PID 540 wrote to memory of 1236	540	msedge.exe	91
PID 540 wrote to memory of 1236	540	msedge.exe	91
PID 540 wrote to memory of 2084	540	msedge.exe	92
PID 540 wrote to memory of 2084	540	msedge.exe	92
PID 540 wrote to memory of 3548	540	msedge.exe	96
PID 540 wrote to memory of 3548	540	msedge.exe	96
PID 540 wrote to memory of 3548	540	msedge.exe	96
PID 540 wrote to memory of 676	540	msedge.exe	97
PID 540 wrote to memory of 4828	540	msedge.exe	98
PID 540 wrote to memory of 676	540	msedge.exe	97
PID 540 wrote to memory of 4828	540	msedge.exe	98
PID 540 wrote to memory of 2736	540	msedge.exe	101
PID 540 wrote to memory of 3108	540	msedge.exe	113
PID 540 wrote to memory of 4212	540	msedge.exe	114
PID 540 wrote to memory of 4088	540	msedge.exe	115
PID 540 wrote to memory of 3492	540	msedge.exe	117
PID 540 wrote to memory of 3492	540	msedge.exe	117
PID 540 wrote to memory of 4396	540	msedge.exe	125
PID 540 wrote to memory of 4396	540	msedge.exe	125
PID 540 wrote to memory of 2452	540	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://share.google/MddzQhJ6Mb6pEtFcC
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ffa66acc188,0x7ffa66acc194,0x7ffa66acc1a0
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,10946449268590621810,7344031744063801192,524288 --field-trial-handle=2312,i,3153998844970296939,9254132391148387767,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,18059997984024448132,9960590838884357931,262144 --field-trial-handle=2312,i,3153998844970296939,9254132391148387767,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,16718106397459223799,13644669434427567404,524288 --field-trial-handle=2312,i,3153998844970296939,9254132391148387767,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,8760844350144146786,8663881692942266321,2097152 --field-trial-handle=2312,i,3153998844970296939,9254132391148387767,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,2790836555944748794,5354264768038919262,2097152 --field-trial-handle=2312,i,3153998844970296939,9254132391148387767,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,16164574714277074624,15643101650077178410,2097152 --field-trial-handle=2312,i,3153998844970296939,9254132391148387767,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,14035699150560596683,14205417855096670822,2097152 --field-trial-handle=2312,i,3153998844970296939,9254132391148387767,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:2
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3668,i,15230268963596621469,14298749627366460867,2097152 --field-trial-handle=2312,i,3153998844970296939,9254132391148387767,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,15343102640825911670,14457566036969786709,524288 --field-trial-handle=2312,i,3153998844970296939,9254132391148387767,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,15211332749821965042,17642865200662439751,524288 --field-trial-handle=2312,i,3153998844970296939,9254132391148387767,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,16207468711454386854,14642456529980384296,524288 --field-trial-handle=2312,i,3153998844970296939,9254132391148387767,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,16207468711454386854,14642456529980384296,524288 --field-trial-handle=2312,i,3153998844970296939,9254132391148387767,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,13830164648956074347,4613568782204999311,524288 --field-trial-handle=2312,i,3153998844970296939,9254132391148387767,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,2981070650810636847,6891124577374072410,524288 --field-trial-handle=2312,i,3153998844970296939,9254132391148387767,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,2071197338458099913,8675449650400560048,524288 --field-trial-handle=2312,i,3153998844970296939,9254132391148387767,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,18384514244181120891,15243493907066126135,524288 --field-trial-handle=2312,i,3153998844970296939,9254132391148387767,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,8968021715525128107,12591717503257911944,524288 --field-trial-handle=2312,i,3153998844970296939,9254132391148387767,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5820,i,7596968232695044794,8829398949708385526,262144 --field-trial-handle=2312,i,3153998844970296939,9254132391148387767,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 31162b91c797e29830470da8f8106af20f8f8c2cac89f1a9bc9a0e94126d1e07
MD5 9604b6b8ae471e3da365917fdf45cf72
SHA1 fef60a000101c01b68d18445d569db2fb87e6a97
SHA512 10dbc49a926c9f0ceab35f96a01e527dbc1433b0728c1b888cd8c11fd2a8e1d7c6c0e9c0c318b98a39200f3c93aa103b715024cd1838d3b96f7e21dda878cd74
TLSH
T1A371A68850835C04FB4D64BDA3DF2AC731358FB149772D420AC2CC3ABB66F5F900A2A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1b211523fe82ada302244a8c3d3e3875d06871909a08a8a6a32bd1535059aa60
MD5 d85a23571845f984d993037ff8ee3e78
SHA1 6e926e8296f087016b69881fb82f5a21dc38b53f
SHA512 b9e6873b9d178c9c5a61d5ffbd527c6bf62d4501e5d29804951712649621c1de8ee4e07a399e2d5ae7d52dad9e46663c3619bd5672e2874557f833c3eb4ea11f
TLSH
T15571A78451935C04FB9820BEB3CF35C735368F7449732D420AC6CC7ABB65B6F904A2A8
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d7e4416cdb5ab05a4f3a0aab38eef31e74eedc7023591f42b86c43809121465f
MD5 3984b8f62ddf9046189d71c4c9a9acd1
SHA1 1a816628bf008304df8762dfe5e588c88acc2b88
SHA512 624b765e4a59d4299d9dbe606d8cda9b320adad9c0b47697d503e161752f18a4fa614049c4973b332298e0dca577671185a4b3b4e99cef56b9289ea5f43f355b
TLSH
T10651BCF7C3F4867DC90196F0AB24AE1BCF2D0A24432C7D59C4D8AE2BA7E2471E14155E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 9e13a3afb359773c58de243b3975096ec62e87b352acce5a477f1b94d62743b4
MD5 dc6a68702498b07d1ff3f6553af97867
SHA1 17dab476333924c17b1f06091194aa2315e3ecf8
SHA512 91301dfa832432db41ad7b616523167ea01882f4a608d58a9ff31918b6ca32f1cf7b85f3c7a7e2ddb7f06187a62196e7a53835166e9e9bb822f10af369a14c87
SSDEEP 192:sxZMRrWK/frsfAzIdpz7HW6+WNLML/YaUh+IIgrJ:sxZMoK/frsfAsvHb4/KH9
TLSH
T12022A8527E68A57B8CCBD20DBA15BF53D6F9103291951E48EAFC951C04EAADD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 29258b45001aefdf7c80220489136038f4d26e7dbbea2ffaf023f6fef2c95520
MD5 b9fc99bf5f7f47357d63767054fe5d8d
SHA1 ed5a243fe3e32ef5cb61b574ab9d1fab1751f302
SHA512 6b19a2b8d837357d08657c8a73eb17d3fb3d90f4d17f6ba4559018a360e6b58755150b066030b4f34ed81d0d230d2ca6871ca3a6159a5a52a90628b0f45d5982
SSDEEP 192:sxZMRrWK/frsfcNzIdpJZHW6+WNLLAdYaPh+IIg5FJ:sxZMoK/frsfcNsvHbodBHZ
TLSH
T1D522CA517D68A97B8CCBD20DFA15BF53E6F9503251951E48EBFC861C04EBADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2588ed627284a30012b982eefdd0cc191e7c6d1be734df9cb70e03b6dbfe2dac
MD5 b250f25c3eefe8c26dc17c35f2b69045
SHA1 d8bc685706026e7bf7f8cbf0dc3ccc0c798e55da
SHA512 9e6973ec4b83c32d262c3330389848eba5b1d782e983f8f6279f138527c04c05c5a5fada8ac5b38fdf492d1faf452e60a2635cd2a9ba789dedead7468a4da086
SSDEEP 192:sxZMRrWK/frs8AzIdpz7HW6+WNLpOXYanh+IIg53J:sxZMoK/frs8AsvHb8XpHn
TLSH
T1A222B952BE38A97B4CCBD20DFA15BF53D6F9103191951E48EAFC961C04EA6DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1a90d12f55b7613fc41aaf69061b12fd0712e4e30443295cc9150c5e3882ede3
MD5 cfca242172616bdcf15ec1b7522323b6
SHA1 20b5d9d3354f67e45eae148a6ee2151b1b626ec8
SHA512 976a276a38b198cd06af43431a92eef77a61c658b1414b2194615eb00e058cc504981176e74343b5829b3d1be9fd1a401aacfb26cf6a1cbe60b429020315b331
SSDEEP 192:sxZMRrWK/frsfcNzIdpzZHW6+WNL5mZYaLh+IIg5FJ:sxZMoK/frsfcNs9HbsZVHZ
TLSH
T1B222B8517E68A97B8CCBD20DBA15BF53E6F9503251951E48EAFC861C04EBBCD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 8a7cf29496366aebd0bf85a8fac5bf3dded1a5ba62ca53bef0c82d80aeb3c638
MD5 71d7425b8cd28cdf41677ecab7268e9e
SHA1 054de92e705e9b1ae2adc44559dd5da4e2c444b2
SHA512 53727b3c3481536c04a5566b73cdbe346577fc9ce7ae76a0865a10ff9893604511deec635d62c61f239a974cbefd53b4419e2958129d4fdef365b7b6697bc4bc
SSDEEP 768:F2yQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3KroaZFR:F2yQRbrWvvlpZu1jaXKLf33haZFR
TLSH
T164C2E92B640CCB7E4FC01E9DDC6A6F976EA802C766588D4047FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59b3c6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b3c6.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 535918a2bc10d588b74ca0808336af72a7c5289b9f9ec4b76f65f99c06b99300
MD5 8d09f13aa9923f7c1cc41d90692bb415
SHA1 05f176f999db0bf5e871a5e76f650e18807732da
SHA512 f78a651397c678737b43299179dec7a6ec24c3b5a930615fca86d81fbb596d27a1503215a8c70827c54b7f02c8568db868d8be2e37b2ddb3f4e93fb92b6eaf84
SSDEEP 384:riFiZcIizsNY8TUNTUlIlhT5Ui6p5u8idaOX4tgOIwZOyILgoy:GFQqJwgj34kdL4XsXUJ
TLSH
T129C219F248E7987AE9AE4743B77D2D038EBCC067F5859A44B798561CCC960BFC306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 818ef066e409f145458a4a7408c70a21bfd1266ea1778639f80cb58f45b59e26
MD5 22212d1bbedb046a35471aa59a5d5d65
SHA1 44488bd449e97a9fed0f8ceaf3d84044e46d6d73
SHA512 41e80adfd0b3856f17f954d5c235f7b7779177297fadb5dc206a363703e8e3bb51ddf8cf83f154220e9bf8562bcb1a2f079d2bdac431927d5a45a3a70ab3c601
SSDEEP 192:SONw6iDCQmiUy9HHq5u88PdPCvGSq+Q+U6:SONw6/4Hq5u8ida2cU6
TLSH
T1A902E738AC287CBB9DF3AD15B58B7B139FA4116FE7951B84C9E81A1C01DB69C1703922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 925b96e8c99d224d18b5dc097a4556d8b7b9f78b4f1f905ecfafd99fd9cfa1b6
MD5 ca6d3aabe84ad59f6a5421dcb4803cf5
SHA1 e6335805646e1a8cb33b8fc7e156f4a3a859b69e
SHA512 d25f49c9804f082baa79e5c0a51905e6733df241d821877adecb2cc096d308f85b60338f0005d5bb6ae5943b576b5665aff0a9fc0d83502dc8ca01f8b3337a0e
SSDEEP 384:XZcIhsNjUcT5Uu6p5u8idaOU4tgOIwZOyILgoy:fhEX4kd44XsXUJ
TLSH
T12C827C329C78ACBE6DFB9554F58A36038FB8846BD3C99F84D9ED671D00DA5D4030B922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 61ec892a1909692cb0a2f2b271e463b46dac95c609365a7299b86f32a22e1f27
MD5 e24273eb9b3051b108e44ab0dbe2cd8c
SHA1 dcc355d88fd05dbf0e354cf486cae0b69abae19f
SHA512 cabb04fe731508ff853a29d6b0e259ec3503bf807741fd8de308e81c634c23379ee340280a942eb6111402459c739663e67bb5e0e849cec990a5dead3f6b107c
SSDEEP 192:SONJ6iDiQmiUyeHmq5u88PdPCvGUetjuZuqEU6:SONJ6/Jmq5u8idaO04U6
TLSH
T129124B35A878BC7F6DE39861F48736139EA4426BD7886F84D9DC262C01EF59C170B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3b1d3b7eab5147888549726b32d14d43e01206925473e94c8adeb2e67478ee7d
MD5 342708fe892a9a862364f17df330a7ed
SHA1 f9cf6de3e09e0bc790b366d8016219c3e2de722c
SHA512 d38b0f8dc6afe76cd4d07796b4b673078a6f8c8901e95b0e30c96212ae7cccc1ab0c0ac03e44d71a9a7dfa15286c257de14a0af59567352f083c18ae0c593ad1
SSDEEP 384:WZcIhsNjUhT5U76p5u8idaOU4tgOIwZOyILgoy:Ehhq4kd44XsXUJ
TLSH
T1E9828C3298789CBE6DFB9554F58A36038FB8846BD3C99F84D9ED671D00DA5C4030B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4fed9dce-e4fe-43b2-ad89-41143051714a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4fed9dce-e4fe-43b2-ad89-41143051714a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 11514aa60391246744616c8bd1db92187cbfbb6e2f04be2971e7137a6ae865fa
MD5 040610f9809504555d023d76790ea3bd
SHA1 10f81ddce4f7f3ff7d65c17e3da962b3c9106190
SHA512 6b776a12f050eed8be2e9d575de79afe93887f7dabf5de1d2b30dc42904dc0b25a2a2cf9fb05dec6d7ecaf23ea7155d1399c48632dce05b3ba4c28c8124b5568
TLSH
T113412998AAF91118F3B36E5AAFF7A46D487B79332F46D46E00110D4F0A66A40C972737
MD5 SHA1 SHA512 TLSH

Submit Download