hxxps://share[.]google/yQELTrHKDkYvIielX

Analysis

max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://share.google/yQELTrHKDkYvIielX
Sample260930-tk6wsazbqd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4896	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{6D378753-3F16-498B-9E46-B8C1ADED0D9D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 1932	1624	msedge.exe	84
PID 1624 wrote to memory of 2964	1624	msedge.exe	85
PID 1624 wrote to memory of 4896	1624	msedge.exe	86
PID 1624 wrote to memory of 2964	1624	msedge.exe	85
PID 1624 wrote to memory of 2964	1624	msedge.exe	85
PID 1624 wrote to memory of 4344	1624	msedge.exe	88
PID 1624 wrote to memory of 4344	1624	msedge.exe	88
PID 1624 wrote to memory of 1440	1624	msedge.exe	89
PID 1624 wrote to memory of 1440	1624	msedge.exe	89
PID 1624 wrote to memory of 1440	1624	msedge.exe	89
PID 1624 wrote to memory of 4152	1624	msedge.exe	90
PID 1624 wrote to memory of 4152	1624	msedge.exe	90
PID 1624 wrote to memory of 4152	1624	msedge.exe	90
PID 1624 wrote to memory of 3600	1624	msedge.exe	91
PID 1624 wrote to memory of 3600	1624	msedge.exe	91
PID 1624 wrote to memory of 3600	1624	msedge.exe	91
PID 1624 wrote to memory of 3764	1624	msedge.exe	92
PID 1624 wrote to memory of 3764	1624	msedge.exe	92
PID 1624 wrote to memory of 3764	1624	msedge.exe	92
PID 1624 wrote to memory of 3504	1624	msedge.exe	98
PID 1624 wrote to memory of 3504	1624	msedge.exe	98
PID 1624 wrote to memory of 3504	1624	msedge.exe	98
PID 1624 wrote to memory of 780	1624	msedge.exe	99
PID 1624 wrote to memory of 780	1624	msedge.exe	99
PID 1624 wrote to memory of 780	1624	msedge.exe	99
PID 1624 wrote to memory of 556	1624	msedge.exe	100
PID 1624 wrote to memory of 556	1624	msedge.exe	100
PID 1624 wrote to memory of 2744	1624	msedge.exe	101
PID 1624 wrote to memory of 2744	1624	msedge.exe	101
PID 1624 wrote to memory of 2380	1624	msedge.exe	104
PID 1624 wrote to memory of 116	1624	msedge.exe	113
PID 1624 wrote to memory of 4112	1624	msedge.exe	114
PID 1624 wrote to memory of 1148	1624	msedge.exe	115
PID 1624 wrote to memory of 4312	1624	msedge.exe	123
PID 1624 wrote to memory of 4312	1624	msedge.exe	123
PID 1624 wrote to memory of 4852	1624	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://share.google/yQELTrHKDkYvIielX
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffdf843c188,0x7ffdf843c194,0x7ffdf843c1a0
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,16190347530034725336,10466708752765037262,262144 --field-trial-handle=2992,i,9670233168510923698,7715255906371283259,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:2
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,17059377119513724584,12343205391184309160,524288 --field-trial-handle=2992,i,9670233168510923698,7715255906371283259,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,135012390783360027,10154226498364789918,524288 --field-trial-handle=2992,i,9670233168510923698,7715255906371283259,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,8722476280843111928,10949723458261925920,2097152 --field-trial-handle=2992,i,9670233168510923698,7715255906371283259,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,1159711911680880958,2285113200958906857,2097152 --field-trial-handle=2992,i,9670233168510923698,7715255906371283259,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,18150293966813385362,2035816213166108563,2097152 --field-trial-handle=2992,i,9670233168510923698,7715255906371283259,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,4352434441145968214,14355724092334315689,2097152 --field-trial-handle=2992,i,9670233168510923698,7715255906371283259,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5088,i,10871193157931817405,8774507777149607356,2097152 --field-trial-handle=2992,i,9670233168510923698,7715255906371283259,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5252,i,16919789076797694150,8334382820327579335,2097152 --field-trial-handle=2992,i,9670233168510923698,7715255906371283259,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,6172862847361372754,12181402948738380421,524288 --field-trial-handle=2992,i,9670233168510923698,7715255906371283259,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,17309757952617417859,8623709400577331153,524288 --field-trial-handle=2992,i,9670233168510923698,7715255906371283259,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,6421496258459498956,15332279157871311604,524288 --field-trial-handle=2992,i,9670233168510923698,7715255906371283259,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,6421496258459498956,15332279157871311604,524288 --field-trial-handle=2992,i,9670233168510923698,7715255906371283259,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,4613663683623161407,10586079539887347891,524288 --field-trial-handle=2992,i,9670233168510923698,7715255906371283259,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,11027633066586628680,12328821600548913242,524288 --field-trial-handle=2992,i,9670233168510923698,7715255906371283259,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,11009964186826963511,16088279790226519671,524288 --field-trial-handle=2992,i,9670233168510923698,7715255906371283259,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,11284843711519872597,11176884948744831364,524288 --field-trial-handle=2992,i,9670233168510923698,7715255906371283259,262144 --variations-seed-version --mojo-platform-channel-handle=1204 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=752,i,855485188845985264,7331643506081602757,262144 --field-trial-handle=2992,i,9670233168510923698,7715255906371283259,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 68d0023186d686ac9ad4b7e72db73ae07020aa7358b60faec829adc075c278b2
MD5 c9f089553f7016d50a49b97a4569e96d
SHA1 6707b0c50a427b087e951e26f278cf798036cf81
SHA512 971d4f41c31a7d5ac2f8dc456cbf29d9db212ab641897bc20a9e74d26ff48d5617d0c4467cc891187660c10f57c2b4dc7feb656733dc52650db92d384959117d
TLSH
T1CC618280177382DDFF54A6B551C553DB3232B789899BEC4215B4DB7AF80A79CB051D0C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589de1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589de1.TMP
Size 3KB
SHA256 669bedf2c79cb76863c0a4b0eb88154b0a1a3a79a1385864bd09353f89f94cfc
MD5 a924a90495f93054bd0f5a73ab446099
SHA1 a1ac764ccdad80e89c34e2669abcb4dfda12c9ad
SHA512 a975857b9706d6f94315726dfd268371ddca49b68e7759e8f98e3e06c1eb4a719ea11f5d26766fa5cad2b3cf505729d856c40a328d8f8e28167cda923a2e159d
TLSH
T15A616F80177382DDFF54A6B595C553DB3232B789899BEC4215B4CB7AF80A79CB051D0C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 be011ad67285dadf35bf8d05379e00c135439d42154f862c062a6e872b75325d
MD5 b59c04856c9682020929663b1dd428e0
SHA1 4e53e020bd144a8bf1cc3ecfec1865ed0c68e936
SHA512 fd709a14f5a4c0a1af701eafd07a9e983184046f52e1643cd8cc993ac83d0499364cdf92ee3dd702985a8df482e4238ac890d4c22ac1a92b46ba6448d8be48f6
TLSH
T17A51B9F3C3E9826E896516F09B246E2BCF1C095843283C1AC8D8EF1B93E2871E15164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 db8c5f8e6968778727f37c0d1b3d233b575cf291136eda1564f1f7e3f05a642d
MD5 8e6cfcf06ccaeda59ee0be6a83613a7a
SHA1 8182500086e2bcf029b1f4cf389d30d4f01a36d7
SHA512 0e369e02566c219e15c636d3c69659814821b40b149c71249b45e23537361cc67b72b446983acce2000367bee03f29e535b2216b95b75716f10f427e2e7c2a09
SSDEEP 192:sxZhRRWL/fes87bIdpWlwHW6+WNGYYBapoIgrJ:sxZhaL/fessEjHbGf99
TLSH
T1D412B8516E28A97B8CCBD20DBB15BF53D6F9503251D11E98EAFC861C04E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 880ec9b726539403431b36c0c4233318e35117bca0b61474940af3f2bafcc198
MD5 1b4666c3eab096bd6d9888253e92a5a4
SHA1 8f03959dbb298d879f7a95f88fd942bbaf958afc
SHA512 146a70c7aa1bd6ab56861006acfc1ecdc6ab2728620554ff61550f9a1e13aa4d01fcb353ebe1be14c342ea70fb0bbd7113f75837e6d973c06501fbd442594aa9
SSDEEP 192:sxZhRRWL/feswFbIdpIlwHW6+WNGYYBsApoIg54J:sxZhaL/fesiEtHbGfki
TLSH
T14022B8526E28697B8CCBE20DBB557F53E6F9503251D11E98AAFC861C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c4b32330442709ad769470aefe4f6245ed8812be41b08e27165ef1aa6a60909d
MD5 d9c64283920ad2894099e93db9d46aa9
SHA1 61770de9811446361bf162c6f8800c36c30a3148
SHA512 c698ba0d10b577d6c5f65bbeee29c5bff1bc20830b609482c5788e95a602bf0614a958bb7d36ee617e8dd97568cafc1ac0583a2384aaf30e8713ce3c1243ff20
SSDEEP 192:sxZhRRWL/feswFbIdpWlwHW6+WNGYYB17poIg54J:sxZhaL/fesiEjHbGfki
TLSH
T13622B7516E28697B8CCBE20DBB557F53E6F9503251D11E98AAFCC61C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 0405e3abb8179c0c2232441c2db04bad9a0578a5ec95de69b879f7796589f75a
MD5 26a4be20ef53537c71f349eb40035ec9
SHA1 4fb9aba6e3a52f89cc6060e108ce007e62f64703
SHA512 362bfc66e62455252fd4d4922f28a003b310ebf30e0cec9f89dca3c91b8692ae3b84a3f0c22f74f1ae2fdbbe020edea266ebadaf459f9952b13afc9527818dc8
SSDEEP 192:sxZhRRWL/fesw7bIdpWlwHW6+WNGYYBapoIg5SJ:sxZhaL/feswEjHbGf94
TLSH
T12222B711AE28A97B8CCBD20DBB55BF53D6F9503251D11E98EAFC861C04E6ACD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 5b2b8b0f13e9c18d63522f2a246235ffb237986f378fb28e52258ee34ed6cdf2
MD5 4058c2d4a2785eac9bece3ab6227b474
SHA1 7cf2e1e08c625f318593b6d97e8072b3b5af534b
SHA512 db9089b13a5e55bf79c6b2b1df4d4742f0574d99836249c34c72fe63128d9497ccf962fb2530ea715524e3c915e02e1c519f0ba802a3533594abc9b5e8b6a979
SSDEEP 768:XMyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXQropt/8:XMyYR7jWv3NpBu1ja/CL8OX7E
TLSH
T1F7C2E92F644DCB7E4FC01A9DDC5A6F9B3E9802C7A6548D4047FA984C02C77EE912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3bdf9fe-6f56-4b39-a580-dc740667e040.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a3bdf9fe-6f56-4b39-a580-dc740667e040.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1408f80c308cc94efdad0dfe995183c7fd194f5ffd5f5ee1aca7feeb92669da4
MD5 b0c887efb2f491e06ad41d4c7d66ad13
SHA1 ed135da11b89c170dca5a0fd0018088bb31f4a34
SHA512 18ce2aef23a415769631ef498cb865b509f23228bf7ca60df8f12c098db30d4db068d701b935d7b31683e813493ad2e1a785d9f9895806a9c4030bbf8d575c67
SSDEEP 384:dZcIhsN9K1RCwiHlZQX5+DtbOt1AzmJrUsmtgOIwZOyRLBon:FhFRXmekDlOkzmhUsmXsOtE
TLSH
T1EA828C32ACB89C775DFB9185F18632035FB49567E1C9ABC0D5EC6F1C01E9AA8130AD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 9f1227a848f7e619c94fc6629d9c50fc3cd310dad7ab4b06e3468c0240ef3efb
MD5 7f723759018692a8e8e18674bf39a8c2
SHA1 57af2b0a69c173a6a2971832b0511cb7ea2cfc3e
SHA512 b3429d5069143db06694b62bb1faaf5b3e3d025d5fc6baaa8ae0992672d3dceb1d55157e895ab8130b7b59ca23bf2a5bc8f47fd5b30b8fd6bcef826c0c7812f2
SSDEEP 384:ViFiZcIjzsNH8TUNTUlIlf1RCwiHlZQX5+DtbOt1AzmJrGsmtgOIwZOyRLBon:cFQnGwgrRXmekDlOkzmhGsmXsOtE
TLSH
T1E3A27D339CA8CD7BADFB9A85F58A32039FB45167D5C5EAD0E6DC6E1C009A5DC030AD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c45b311609800eb0f8ef5b3df9f773461d7e7589c3f5a9f1fb54cc451a6d7d9f
MD5 95d5b368d99c240890cf1e48e65cc22b
SHA1 e5a669915e21cc2e90917d2eb95bd2c0c4d4acef
SHA512 cf330ea9e1a2393ef6e052924d5f7dc7e820b982456a8fa64c48150e74a5d4d66b28f5f1c929fe24aa121c0b06517efd1b037962ec5026c4d1789fe9c5523dc3
SSDEEP 192:EONp6nnHGQmiUy4VQYcX5hQDP1bOt1ATcMckFU6:EONp6nC5QNX5+DtbOt1A0oU6
TLSH
T1E002EB34BDB87C778EF3AE46B48637175F95217BE5942BC4D6D81E1C00DBA5C230A922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ebfbfc8ca51c24963420b3dd081dcb04c0566dbbfc46899bf17936e5e8749fe2
MD5 e1f494292b554ab67a7fcade01efe4d4
SHA1 87ab7b4e882c3c581a5f39dbedb6c243a9efbec4
SHA512 48dfbf403ae9bd81f1df0edf84c30aeba01dfaee29df2e4dd187eb6182b252baecaf3bc9df7e0dc6fe8d72f98d9d5e500a3322a8710ce7c28ed6be69a23303eb
SSDEEP 384:4ZcIhsN9f1RCwiHlZQX5+DtbOt1AzmJrUsmtgOIwZOyRLBon:Gh8RXmekDlOkzmhUsmXsOtE
TLSH
T10E828D32ACB89C775DFB9185F18632035FB49167E1C9ABC0D5EC6F1D01D9AA8130AD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a941034910801a4ac03d6b8fe2c3d832129824709588a971825c50f9260fbe6a
MD5 0be089a3b8d25fbc673bc7b8766f3e04
SHA1 cdf56ce4a7e785f4953eb9a6df227c7796cb79cc
SHA512 8ff035254bd58caf6e96aafcf3bfce97277e218982ea2cd02f476025b06673ac3b9e20663e8a2f03c6d1b6534b84326e5a0766939c856f7372bbfd28cf94517c
SSDEEP 192:EONw6nnHvQmiUyPVbYcX5hQDP1bOt1ATXhhSJrQg3/q5mU6:EONw6nRKbNX5+DtbOt1AzmJrLsmU6
TLSH
T153122B31B9A4AC775EE2A585F08732179EE45267E5897FC0D5DC2E1C01DEAAC230EC62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac4cb66d-bda8-44a1-9d20-4bc5576182a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ac4cb66d-bda8-44a1-9d20-4bc5576182a8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3a80691a9cb84b264a8a2046a327b531fe03120bd8a680e7eb8bf7c53a353146
MD5 7811794596a19d8457091d7206fecc15
SHA1 1c2a6f02400436c5f2af8aec0353a1a660fe69c4
SHA512 b90fb5b5040ed9f3a340eb34323dbf55924cef1023a05c8249ff9435e5103f1f19dbfa6fc20e5f5e23d9bcb8fd180cdce7cac82524c5a47af20bd0b83d127a7e
TLSH
T12641D858BAFA1108B3B76E56ABF6A82D487EB8772E4BD45D00010D4F0A62B45CC61B77
MD5 SHA1 SHA512 TLSH

Submit Download