hxxps://share[.]google/x7FcwX8PctE6ehgwF

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://share.google/x7FcwX8PctE6ehgwF
Sample260930-tcb2faca37

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3776	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{3CADB7AE-631A-4FFA-80E6-CBA85EEDE247}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 4404	3488	msedge.exe	88
PID 3488 wrote to memory of 3776	3488	msedge.exe	89
PID 3488 wrote to memory of 464	3488	msedge.exe	90
PID 3488 wrote to memory of 464	3488	msedge.exe	90
PID 3488 wrote to memory of 464	3488	msedge.exe	90
PID 3488 wrote to memory of 764	3488	msedge.exe	91
PID 3488 wrote to memory of 764	3488	msedge.exe	91
PID 3488 wrote to memory of 4980	3488	msedge.exe	93
PID 3488 wrote to memory of 4980	3488	msedge.exe	93
PID 3488 wrote to memory of 4156	3488	msedge.exe	94
PID 3488 wrote to memory of 4980	3488	msedge.exe	93
PID 3488 wrote to memory of 4156	3488	msedge.exe	94
PID 3488 wrote to memory of 4156	3488	msedge.exe	94
PID 3488 wrote to memory of 4840	3488	msedge.exe	95
PID 3488 wrote to memory of 4456	3488	msedge.exe	96
PID 3488 wrote to memory of 4840	3488	msedge.exe	95
PID 3488 wrote to memory of 4840	3488	msedge.exe	95
PID 3488 wrote to memory of 4456	3488	msedge.exe	96
PID 3488 wrote to memory of 4456	3488	msedge.exe	96
PID 3488 wrote to memory of 4812	3488	msedge.exe	100
PID 3488 wrote to memory of 4812	3488	msedge.exe	100
PID 3488 wrote to memory of 4812	3488	msedge.exe	100
PID 3488 wrote to memory of 4520	3488	msedge.exe	102
PID 3488 wrote to memory of 1504	3488	msedge.exe	103
PID 3488 wrote to memory of 4520	3488	msedge.exe	102
PID 3488 wrote to memory of 1504	3488	msedge.exe	103
PID 3488 wrote to memory of 2168	3488	msedge.exe	105
PID 3488 wrote to memory of 916	3488	msedge.exe	118
PID 3488 wrote to memory of 916	3488	msedge.exe	118
PID 3488 wrote to memory of 916	3488	msedge.exe	118
PID 3488 wrote to memory of 5044	3488	msedge.exe	119
PID 3488 wrote to memory of 5044	3488	msedge.exe	119
PID 3488 wrote to memory of 5044	3488	msedge.exe	119
PID 3488 wrote to memory of 4292	3488	msedge.exe	121
PID 3488 wrote to memory of 3556	3488	msedge.exe	122
PID 3488 wrote to memory of 4716	3488	msedge.exe	123
PID 3488 wrote to memory of 4216	3488	msedge.exe	126
PID 3488 wrote to memory of 4216	3488	msedge.exe	126
PID 3488 wrote to memory of 4952	3488	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://share.google/x7FcwX8PctE6ehgwF
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x294,0x7ff91aa2c188,0x7ff91aa2c194,0x7ff91aa2c1a0
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,15989283598713221493,6963880251974954153,524288 --field-trial-handle=2024,i,7370633438622378011,5158620330107313453,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,13489417902619599871,10511852597183106134,262144 --field-trial-handle=2024,i,7370633438622378011,5158620330107313453,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,10750984701431673887,16630384091921571872,524288 --field-trial-handle=2024,i,7370633438622378011,5158620330107313453,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,10744687202875534051,3867774142055679780,2097152 --field-trial-handle=2024,i,7370633438622378011,5158620330107313453,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,5871500262425269845,10913740141666537929,2097152 --field-trial-handle=2024,i,7370633438622378011,5158620330107313453,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,6190556993137806959,4280692772093832735,2097152 --field-trial-handle=2024,i,7370633438622378011,5158620330107313453,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,1202290075011074061,1835326273673716845,2097152 --field-trial-handle=2024,i,7370633438622378011,5158620330107313453,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:2
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5112,i,3094564402455122187,14957142243683655379,2097152 --field-trial-handle=2024,i,7370633438622378011,5158620330107313453,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,10390874737807148131,3979715499469009425,524288 --field-trial-handle=2024,i,7370633438622378011,5158620330107313453,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,3014841566318443000,3389799497074379953,524288 --field-trial-handle=2024,i,7370633438622378011,5158620330107313453,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,12411675405519919970,13772204933431396901,524288 --field-trial-handle=2024,i,7370633438622378011,5158620330107313453,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,12411675405519919970,13772204933431396901,524288 --field-trial-handle=2024,i,7370633438622378011,5158620330107313453,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4544,i,308294404456730256,2317385496363468092,2097152 --field-trial-handle=2024,i,7370633438622378011,5158620330107313453,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4600,i,5258785070865561707,11335192364608149362,2097152 --field-trial-handle=2024,i,7370633438622378011,5158620330107313453,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,3754218555379621141,6417323209869270939,524288 --field-trial-handle=2024,i,7370633438622378011,5158620330107313453,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,5994098794270474467,856036570012913888,524288 --field-trial-handle=2024,i,7370633438622378011,5158620330107313453,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,6560435692113648470,9994430572974179005,524288 --field-trial-handle=2024,i,7370633438622378011,5158620330107313453,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,2336739749273796567,6686181248396548766,524288 --field-trial-handle=2024,i,7370633438622378011,5158620330107313453,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6528,i,17160610631455767532,6562683971898349450,262144 --field-trial-handle=2024,i,7370633438622378011,5158620330107313453,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b83cbf64cc348bda7418cf4d51290f954f1a229bfc174076604c71e6316695b1
MD5 e74d8b44e8d40662fd1b1b255738f7f7
SHA1 274571a893d99afe45f887bf62213edcdf6ce25a
SHA512 fdd52b8ff528e9564308a28f53b7774dc738711d7dccce592af97c88bf2722ddb380e7bf76101bce36a685c115e53c6bb3d415de6eecc3c382b674f304fb5a40
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7j:fwUQC5VwBIiElEd2K57P7j
TLSH
T1B2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 66d285485d126fb3ff6b21f5ec8b932a56d365e49d0fe7a5120da5934ba0215d
MD5 ee7da9e4a7c5e6123fffa0e68fb51b38
SHA1 de2d2f4ba82b69b6c7a36d49ae45f3b4c76c6c08
SHA512 99b952d4d2a8422c6e94f8cc6fb5e4898fe2d0398d185dd1a1c06c0d0e6331fd99b0218f8d77ec1b2c2e99d6412a25470d908058e93aac9054225dc369c550b2
TLSH
T1E351E9A0BAE0C041F7B553B561CD3EB33632E56881735F2111B8D9FBDB227684A8A3D0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6f745260b760fd751c863b31e7b077554b1c5976d2e3218ca72a474acd298787
MD5 67b6eb6f7189a072bf5a38051c41cc82
SHA1 5918b31a2014456088e8caf737128583c7e2f12c
SHA512 120ede7ee57e6030046debfc44b8258122f4224d77fd16901ca104cd196e8b8dc9a49e5ca947bc52e4aeb659e9ae06a41e12bae98a66c9f928db7a0844651637
TLSH
T1F151ABF7C7E1822DCE165AF0AA24EE2BCE2D0515431C3C5989D4EE2BD3E2471E106A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1fb1d55f1a42263c667b3c6c97c61b8698726a7a6e07bb00f190e60c9cb14efc
MD5 f093c208162e8216e4c86583ede01185
SHA1 ed56e992efb75c01ec97c6043bcfa94cee6f69be
SHA512 10cfabfb26f2a6c36a9b8dfc6ad36eef153aea25910bec183728f61e85528d6abf9820ec6fb5d66f1a2545479d285698d0867a988ad7db8d5f3d7b44dcdd5a8b
SSDEEP 192:sxZiRYWx/fss2nrIdp4jHW6+WN6HpO/YgbpG0IgrJ:sxZiBx/fss2n0iHb//T9
TLSH
T19122C8516E28A97B8CC7D20DBB15BF53E6F91032A1955E88EAFC8A1C04E67DD1207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 546f822557409d48fbb0473a44d79f44250739f26f4897803f0bf1c717d9407a
MD5 236cafd4419c76ab9575b53c246049a3
SHA1 c22a7f330741020479cc49739573da2219cf2f74
SHA512 e659fcb342430c58b192b08fd888cf4b039926b3d309d2f47eb980b444ec7266d2d71b909e607e53f650e1ab541652a1cb354c18fc73b5f5da100c0dbeb65c70
SSDEEP 192:sxZiRYlx/fsszOrIdpKDM9HW6+WN6HpO/Yg7pG0Ig5OdJ:sxZiQx/fsszO0XHb//PS
TLSH
T1AB32D951AE68A97B8CC7D20DBB15BF53E2F95032A1955E88A6FCCA1C04E67DD1207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 461e0e9853fa4dc79b56bc7c0311d2eefb7eca5376e35511d27ecac8526e29e9
MD5 aa3bafbabd9843ff17601af0b343ddb1
SHA1 1725907c2ce42b296486d6d954a76eabfb397ac7
SHA512 4136cb5a94098541d2a08d52661d27591935b97c740c77b8cf44061b7f30d72933a62b474bd835a7c455e9289b81743056c8b34117c08d5d29fc351ea1baf5ce
SSDEEP 192:sxZiRYlx/fsszOrIdp4DM9HW6+WN6HpO/YgvpG0Ig5OdJ:sxZiQx/fsszO0ZHb//bS
TLSH
T10722C951AE68A97B8CC7D20DBB15BF13E2F95032A1955E88A6FCCA1C04E67DD1207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6b723a2223f05e1492172534d3bca18cdecc0b61f4ca658d43fee620c8ab6fbe
MD5 43182de72df81fc8331770f56c464c6e
SHA1 68a9924ad00546139afe3303f6e63040f36e069a
SHA512 2e191d69688dd99788ee9d324e22f02d6c4e9fcfaf54a54dbc61a3333758c32fa329b4870a0279d12b6af054098af88823323b774bf1dc24d93b13029f9e1f14
SSDEEP 192:sxZiRYlx/fssznrIdp4DM9HW6+WN6HpO/YgbpG0Ig5O/J:sxZiQx/fsszn0ZHb//To
TLSH
T17C22C851AE68A97B8CC7D20DBB15BF53E1F91032A1955E88EAFC8A1C04E67DD1207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c74262715cc4fd10f604d57771d0a8ee137742d6c2e87f5e22e7cfb7e0dbd257
MD5 d88a443f9cd4ba14732a67ba871e9b82
SHA1 22d11253cf7ccbdcae24809ccf37192afc6d15ce
SHA512 afec16ff6a796f7e992fcce90440b24e7f17d89fd68170fe3b6cc0d1db961f9e561deebda87b4c9698678fb30885f6840a6e6201b60d63b6b5d4e0ef9c68774a
SSDEEP 768:PcichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXz6rookf:PcichfPWvPZplu1jan+LKgzxJf
TLSH
T197C2FA3B644CCB7E4FC01A9DDD5A6F9B7EA802C7A6588D4047FA984C02C77EE51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 736625776622f8a04f2d93d3b16a943177092929392c0c75e7cb3b8796581ead
MD5 c946d3268732e85db42890c101208351
SHA1 0b1e53e0afe09ddcf8ac3615b5ce1dfeca557116
SHA512 fa3ba8dc61fcf21d8ab886e92256a794c899daab76dc15a44d7bbcce8d22e2dcc1ed11c5d991d32e4b1d3b81dda826dc1a7da3bd28fe555a4c3206e45ed910f6
SSDEEP 48:K07+/bldd+bNglIS7+K9L1J+xTuYIZrfyL4N4s4h494P474/4gb4T4m4zIS414g9:KEIQKFW6WruKAs3bWKQMi+BiK64C
TLSH
T121C1E341307B064638BD254C80B5872E464235B3316DF6BBFFBD48A28A6AE441DFF8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe598bfa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe598bfa.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ac72f8259668b6c19fb0a5514fc7d634a2d109a01909a23dbde8fb53dc6fddfc
MD5 7e84b4aea0f303b16cbe3df6feb0967d
SHA1 1b378c501b37ee10df8c477dde656f0c28d8d8a2
SHA512 456af7c8d62c7ca5c1a657645e9f43e70656740905e63c44842fd32af9e9bde07e4b6b1ba1e48722248b22598b10dcc2b158cd563d6eb3e34f0c37cb5d82ad99
SSDEEP 384:FZcIhsNeWuL5oTpxUBGYX5EDtOxlLjYtgOIwZOyGLSok:9h5CYGYuDtOTLjYXsB+b
TLSH
T168828E329DBC9C7B1CF6A145F18A36035FB89027E7C8AF94D5EC6B1D01DA698130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0fe3360385a3dea2c05980772bb14cccd7518601076f37b5a7b846603fb0aee8
MD5 3d98da395e9295e60d0118c2df05aaf0
SHA1 2fa400ddbc2fa9b7ba21e71028cb4c4008dec958
SHA512 4aacdd4fa160a465842b1ab37e9a28e9e41bd589b37ff25ecc2ec92432e6ccb839cb8a14e9d90394f21a7a1b18dc6a6b0e5a2724608aafd806433b1c3d583284
SSDEEP 384:FZcICsNeAuL5ovDxSBGYX5EDtOxlLjYtgOIwZOyGLSok:9CrQ+GYuDtOTLjYXsB+b
TLSH
T1CB828E329DBC9C7B1CE66145F14A36035FB49027E6C8AF94D5EC6F1D01DA698130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 dbe4078427e91d4d9818171d5768dcaf867dce9f77a58691aa735419060ec841
MD5 afd3d5f19a42b0e6c1bd8664afc418cb
SHA1 82d3372414da60213b20ee431df8e8e5a3e00f29
SHA512 058fa28250e7ad56f25f18cff85acd05833c250bac76bdbf1e3b29cac1432260ae2e03fddbd719269a5697611833cf47a8f2aa614fddfd1b9e3eacb9dee664fe
SSDEEP 384:pfiFiZcITgsNu8TUNTUlIlduL5ovj+QxSBGYX5EDtOxlLjYtgOIwZOyGLSok:pqFQMHwgGs+Q+GYuDtOTLjYXsB+b
TLSH
T1D7C21AF249EB887AD8AE5747E77D2D038EBCC017B584AA50B3985A1CCC961BFD306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c366b516e704cd19a33691d38484186484f1c2f7f024435cfb0f823af03a8090
MD5 8dc5d9ca38ecdae6f6bd3deb174f7f3b
SHA1 dfff0faf0c7f04aa3d732402776ff783a4b6b502
SHA512 b4b20934ebb423671b650f8f721ccced4dc2ce1b55c4d931c1691e3bae81da91da8b31facb0c10ae4db4ca4892957e238c42ce738fbc6ee3b98e1186e2cdbf50
SSDEEP 192:LJON46DphmqQmiUyVdq8wGYX59ezSCtORX/kk7GnU6:lON4619URwGYX5EDtOxnkU6
TLSH
T19002E835ACB87CBB8DE26E45F58B37139FA5102BA6946F44D6D81E1C01D768C2306C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ef32e9f76bf9bbbfc9c0b83cdebf32b3b852da4dfecd4323f6ec7eae80f36dd8
MD5 f4359d3c490a89451145822e9220f7b4
SHA1 d5aed25e149645abb5918786c66d2652ece19d21
SHA512 c486f7911be4975e8d70f9f579b666f451778c374aab5c9c973cbf0eeec8e200d265aae831c88d7c58944ed6467dce799797ec852d9f231909b7eeb39aea1a0b
SSDEEP 384:B5ZcICsNeduL5ovDxSBGYX5EDtOxlLjYtgOIwZOyGLSok:BRCOQ+GYuDtOTLjYXsB+b
TLSH
T14A828F329DBC9C7B1CEA6145F14A36035FB49027E7C8AF94D5EC6F1D01DA698130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7d918caa683655c989073945d65957096950b853b5504c1c31487eaf6de7bb12
MD5 69d0847667f0807a40d0473f5725175f
SHA1 ad99f8254573535f09b48b0753ead4c2154c5daa
SHA512 5d6f0409feb12f262bd16ba384b9cd089111ecbdaa65358133635e762355687d485210ffcfc645688114ad879ddfe34ca4a5839db09b28922479d4a315823d35
SSDEEP 192:LJONP6DpheVqQmiUyYdx0wGYX59ezSCtORXlL/kIIWq52U6:lONP61MUXx0wGYX5EDtOxlLIYU6
TLSH
T11D121B36ADB8AC7B1CD26554F08735139FA45127EA88BF94D5DC2E1C01DF69C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a0c425f05e3f8740e0dfd46f75077f03b2152cef19787311f0fc8916f0579a48
MD5 5983daa73720fc2027ed827a4abab661
SHA1 34937b9d3477d3b23f46e1ef1234f31ab950a1f0
SHA512 cebaa21a50e7854f9c79a4396f5f8700be59002b838fe2a3c49e289caa4ba2d25d6ee5a81fd8f2fdfd7379359bc5a8248a0e7319b1b3e5a2825a533c284d4a01
TLSH
T154412798BAEA1108B3B76E599BF6B86E447BB9371F0AD49D10010E4F0663A45C871B33
MD5 SHA1 SHA512 TLSH

Submit Download