hxxps://share[.]google/WbNwudEmE1Vj3cug8

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://share.google/WbNwudEmE1Vj3cug8
Sample261001-npjddsah86

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
992	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{529A1988-D5CD-4973-B859-FD783EC1EE38}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3044	msedge.exe
3044	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 3252	864	msedge.exe	84
PID 864 wrote to memory of 992	864	msedge.exe	85
PID 864 wrote to memory of 4564	864	msedge.exe	86
PID 864 wrote to memory of 4564	864	msedge.exe	86
PID 864 wrote to memory of 4564	864	msedge.exe	86
PID 864 wrote to memory of 3820	864	msedge.exe	87
PID 864 wrote to memory of 3820	864	msedge.exe	87
PID 864 wrote to memory of 2224	864	msedge.exe	89
PID 864 wrote to memory of 2224	864	msedge.exe	89
PID 864 wrote to memory of 3668	864	msedge.exe	90
PID 864 wrote to memory of 2224	864	msedge.exe	89
PID 864 wrote to memory of 3668	864	msedge.exe	90
PID 864 wrote to memory of 3668	864	msedge.exe	90
PID 864 wrote to memory of 2556	864	msedge.exe	91
PID 864 wrote to memory of 3548	864	msedge.exe	92
PID 864 wrote to memory of 2556	864	msedge.exe	91
PID 864 wrote to memory of 2556	864	msedge.exe	91
PID 864 wrote to memory of 3548	864	msedge.exe	92
PID 864 wrote to memory of 3548	864	msedge.exe	92
PID 864 wrote to memory of 3344	864	msedge.exe	96
PID 864 wrote to memory of 3344	864	msedge.exe	96
PID 864 wrote to memory of 3344	864	msedge.exe	96
PID 864 wrote to memory of 4892	864	msedge.exe	97
PID 864 wrote to memory of 2920	864	msedge.exe	98
PID 864 wrote to memory of 4892	864	msedge.exe	97
PID 864 wrote to memory of 2920	864	msedge.exe	98
PID 864 wrote to memory of 3684	864	msedge.exe	102
PID 864 wrote to memory of 4640	864	msedge.exe	117
PID 864 wrote to memory of 1512	864	msedge.exe	118
PID 864 wrote to memory of 2408	864	msedge.exe	119
PID 864 wrote to memory of 3764	864	msedge.exe	122
PID 864 wrote to memory of 3764	864	msedge.exe	122
PID 864 wrote to memory of 4200	864	msedge.exe	125
PID 864 wrote to memory of 4200	864	msedge.exe	125
PID 864 wrote to memory of 3044	864	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://share.google/WbNwudEmE1Vj3cug8
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff972c8c188,0x7ff972c8c194,0x7ff972c8c1a0
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,10470506330515960773,5479301083240130,524288 --field-trial-handle=2192,i,5843012675433500202,18389947386804658897,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - System Time Discovery
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,8482172448192336919,10592384685395434363,262144 --field-trial-handle=2192,i,5843012675433500202,18389947386804658897,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,4748688474122163266,1186372064988674412,524288 --field-trial-handle=2192,i,5843012675433500202,18389947386804658897,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,8478910616911933810,839236139891439018,2097152 --field-trial-handle=2192,i,5843012675433500202,18389947386804658897,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,16776094465413015517,17858119308137423404,2097152 --field-trial-handle=2192,i,5843012675433500202,18389947386804658897,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,18022011952192761701,3929997865427141513,2097152 --field-trial-handle=2192,i,5843012675433500202,18389947386804658897,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,1063544602388677345,4035408602598699721,2097152 --field-trial-handle=2192,i,5843012675433500202,18389947386804658897,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:2
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5020,i,16522627093788414746,1197764153118106752,2097152 --field-trial-handle=2192,i,5843012675433500202,18389947386804658897,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,7425311509750303680,8210949089676479620,524288 --field-trial-handle=2192,i,5843012675433500202,18389947386804658897,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,17887191105223539321,4661579702397395688,524288 --field-trial-handle=2192,i,5843012675433500202,18389947386804658897,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,8080387348234859745,13636059082499742374,524288 --field-trial-handle=2192,i,5843012675433500202,18389947386804658897,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,8080387348234859745,13636059082499742374,524288 --field-trial-handle=2192,i,5843012675433500202,18389947386804658897,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,15826220410177170436,3015691266972555021,524288 --field-trial-handle=2192,i,5843012675433500202,18389947386804658897,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,6882125105288956524,8051108919600067814,524288 --field-trial-handle=2192,i,5843012675433500202,18389947386804658897,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,10583846064250958766,16707906143598643894,524288 --field-trial-handle=2192,i,5843012675433500202,18389947386804658897,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2028,i,1094669447779996872,9377298527427462977,524288 --field-trial-handle=2192,i,5843012675433500202,18389947386804658897,262144 --variations-seed-version --mojo-platform-channel-handle=1032 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,13347510407577860879,11808130500522405374,524288 --field-trial-handle=2192,i,5843012675433500202,18389947386804658897,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5472,i,14736383841968585291,3541115443374328466,262144 --field-trial-handle=2192,i,5843012675433500202,18389947386804658897,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3044

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

46e72c57-92ae-4b75-b0c9-468997f0720f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\46e72c57-92ae-4b75-b0c9-468997f0720f.tmp
Size 10KB
SHA256 2ba239525e649f6d3bae5cdc50fccc1ca74697092a6b58b155a45d28b01c269f
MD5 487a997d87924dd31ad6e5c769e0f9c2
SHA1 82132d462e3d76a85f3f4e0b0ed13b40442db5ca
SHA512 b55c13b8eb0fba4765378fc583817c50a82b09df7c868463f864d708257806f807421c321b0fcf593f4c728426f5dba268a50c054297dd37cac8424d4aec95c7
SSDEEP 192:sxZcRmWC/fCs05rIdpMfHW6+WNrAe/Ya4SZdIgrJ:sxZcDC/fCs050SHbp/nB9
TLSH
T1B922B8126E38B97B8CC7D21DBB15BF53E6F9503291951E48AAFC861C05E66DE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d18114542ff5236840c0f5e1a01f5b45095bb08a8beb1ebcf887a5a8dffb21b3
MD5 0098fc402155bbfc5b13c7cc731f2733
SHA1 9a6454128ef30193505f275834428e7d15c3c39b
SHA512 6cbe080aa4ddc8a304dc6a0bd3df1a089a752d6f2d26bcb4933a985f76cfec215898304c53fa8ba1bd9e6e92eb830cabc2c6f866639e51222beef639731693e7
TLSH
T18571A4A3D38302E9FBB765B092D69DDB3935504780433F7AC9C4CA75B807B269A1C267
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59305d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59305d.TMP
Size 3KB
SHA256 c117c70ea0c60c49842e194091f43f691adc730077497bf7b6fed6ff05ded609
MD5 f8ea6e3f139c45d965ca760bbdc04ea1
SHA1 ace2e6e7091b0a723c2130fcebbaea615ef07447
SHA512 1bb0b7c06216e59c27b09beee0eb67ec90e9d26b7e3a5db581df2677b4512f0551907eb223cc9dc80bcd643d717191e9aab323a28b574e8d17532cec88e07cef
TLSH
T144615E83D24342E9F7AA65B095E299DB3A38909784433F3AC8C8CA75A407726DA19073
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 26483cee0cb86edddee449471e2c89463fe9bf882027db8d7d0478532ec64745
MD5 90abf5ac974a529bf8923dedd8d50f2f
SHA1 90db9d6a506a79d642bffbeb38eb9582b9c8e98d
SHA512 757540fd350fe806d4d6e116babdc7e81f1351b117217f8248cac17c2631b617fc3ca99d23992b02096465be56fe79bd9252855db2779a90a0ad04f438025ad5
TLSH
T12D31ACF7C3E5956ECA1156F0AA14AE1BCE1D0A15431C3D2A89D4EF2B93F2471E101A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f2df3a2f08d5c648dd08f19a47039eb1080be12b5bb5ba0250a639f93ca48366
MD5 e13af8097e8d0d6d882e54fc81bbc3f7
SHA1 b1e204d68195c49e464ffaca6c8364e007df69d3
SHA512 af1cb7ed472dec3cb31c21153fe92d071ec4a88ab8e3ce369427060a6db860b1c0a6c8fc21ef73f62e42821e1a6785861df1b2591bcc76ec989344a40636a450
SSDEEP 192:sxZcRmWC/fCsf5rIdp6fHW6+WNrAe/YaASZdIg5jJ:sxZcDC/fCsf50MHbp//Bj
TLSH
T16B22C7526E38A97B8CC7D21DFA15BF53E6F9503291911E48AAFC861C05E7BDE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 626eb653f9eac7dff63c40e38383840efa2f1fc0a72be004b7effd81abcb2d9c
MD5 1fc36625c3e60aba8676683a73eb5cb4
SHA1 45d122ff633f7448daa7489d53a97e87236a3c07
SHA512 1f871f06ca6fcaeaaca90651e106085c6602cf16d3bfadbb5bc7b20f4c5c45aebdb0ba9065f26b5ef2536f04e1a6dd9d31a8f5cf0522723e0b36ddf4bab8cab3
SSDEEP 192:sxZcRmWC/fCsc5rIdpMfHW6+WNrAe/Ya4SZdIg55J:sxZcDC/fCsc50SHbp/nBt
TLSH
T18B22B7126E38A97B8CC7D21DFB15BF53E6F9503291951E48AAFC861C05E67DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 dfa02d915da542c8563c270cb4374bb8598e91dac220adacb129f99dd875f7c2
MD5 9b11ed1f6680bbfb5c99621096856390
SHA1 0af5e8061505d6e848b23b2b78e5f1dc7a624f3f
SHA512 19aeb12e36720317ff1f738451ff4855df49a5ae5cba6b80f54015ef0ff1c89d217c879c87fdd1936fd03d4cb766724d17a771fece8e148faf886ca92b2faf87
SSDEEP 192:sxZcRmWC/fCsf5rIdpMfHW6+WNrAe/YauSZdIg5jJ:sxZcDC/fCsf50SHbp/xBj
TLSH
T1ED22C7526E38A97B8CC7D21DFB15BF53E6F9503291951E48AAFC861C05E7BCE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 9984a4f0ae417ff3124a7f92c0ca3024d021aa779e374f904ac895b531d4d151
MD5 94c01ae16a6103e63d59bdd97acb3442
SHA1 3bdd1dd2f6eb8f007aed5ee8b2e7871843d697e0
SHA512 4d1482ee9f03e4789770963bf6af06f4cef26df7a215486fdb4bbb675a1eabd645c8b4f2e6dbea43130044bd314cadc82cf5806d10def16d0254af1cd9913e7b
SSDEEP 768:6XyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH35rodZEO:6XyQRbrWvvlpZu1jaXKLf33ydZEO
TLSH
T1A6C2FA2B640CCB7E4FC01E9DDC6A6F976EA802C766588D4047FA994C02C77EE512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

70982638-7a11-491f-9075-1a6a2760b541.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\70982638-7a11-491f-9075-1a6a2760b541.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b409f84224584be8b6107c0b702a963af19bfdc698695250edca075dc2f163e9
MD5 c398e0d1cbdc24fdb96827c3223d1b0c
SHA1 716f6f29613cefa9cd5cbb59b12c14fceb470b86
SHA512 4d5075cdb69762de4eedbcf42d383d68dec8b9147c6eb33a1d90f4f4961e94f529f62406f4afc158561a8ce901f2706043b0dd48e7b25e1e506e44a4cf3b3677
SSDEEP 384:zZcIhsNq/M+BQ2p5u8ipaiNacittgOIwZOy6EooT:rh4kkpUcitXswow
TLSH
T11A826B366C785C7B6CEB9512F58B76035EB8816BE7C89F84C8EDA71D02EA5D80307913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ef145d6639a04fe419b61fc3090dff1afb0ed03839881ceb3965717ae70347eb
MD5 59fa9ee30ff9cc76c0472dc3880a92b0
SHA1 d28b15bf0d0db5376e3c4741ea2ed16d4c68993f
SHA512 2fc9d2fd3904ec78783e5983242f6180d93aa64f99b5b8cc677b926cf72775181ced0fc4bee8846945a41667320ee26fb9967453a03d540824a9eda663e5a73b
SSDEEP 384:yiFiZcIPzsNy8TUNTUlIlmM+B/2p5u8ipaiNatittgOIwZOy6EooT:5FQr7wgukkpUtitXswow
TLSH
T19CC219F658DB887AE8AE4703B77E2E034E7CC167B5849A44B7D8551CCD960BFC306912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6aca753f7e43130f75b724f330b56e178488166771d7547630f7b65e7101debc
MD5 3e63d90908a61a107bc6918583a1f3c8
SHA1 3842c98743ce9cebf31a5e948c089d74364e1aff
SHA512 1ee8c5defaa9ccc5be4b53846bb6e0bcdc4a50aa4a891a147de9c9ada2e6026953c69429eefe687e64dccf2173a49df86a79b4757d2ac844395f897e67c6ec57
SSDEEP 192:SONH6iDCQmiUyi4Hq5u88PpPCPSqihicU6:SONH6/oHq5u8ipaNiJU6
TLSH
T1C702F8396C783CBB9DE3AD15B58B7B179FE9116BE7941F84DAE8161C00D768C1303922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 01aa76b51ce59aa0230dfba7670e613e1273afff38833f0f81d335ecbc520e0a
MD5 3a0ad9667b5bdb4717f4b34b1526f962
SHA1 d8c8f47abc939a4eb8259bf4584f86ef094ef5ac
SHA512 5a822b33a731037497076a03e226a9f529c6eea48352605194b34df4f49f8702bb7026d3a015d16e7b3dd5dde4dfc7a9241a49a0a32c3eaae54846e4e0122fec
SSDEEP 384:4ZcIhsNqmM+BQ2p5u8ipaiNacittgOIwZOy6EooT:GhtkkpUcitXswow
TLSH
T11D827B366C785C7B6CEB9512F68B76035EB8816BE7C89F84C8ED971D02EA5D80307913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8a8b3de33ccb5d2c9c8a5b310c6b9ddafb9d31180d24a0c7cac660129223b8f6
MD5 ca4c813f44241281524aa3d446806d7b
SHA1 ce7d3b0941cccdc632da8db3c920895533cf0146
SHA512 d6a5618bf3c14dd37a77d9e4bf1f01af3081e7d7350fe3aafddac6b546d8426b95499bae675d849755f4139740b1cb6b5bac619b9f7ea86bbbbd39ff33a9dd95
SSDEEP 192:SONr6iDCQmiUyE4iq5u88PpPCi3dasuZiTqaU6:SONr6nMiq5u8ipaiNazitU6
TLSH
T181123C3678B86C7B6DD39961F04736139EA8426BEB886F84D9DC162C02EF5DC1307913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fa8ea637eae69b37bc54df4189b218bf06b6295e81c882483ba3c2ef5e833e4b
MD5 d015b490d0ef3323143c78c61d2ec0bc
SHA1 7831180110f8b0f5c589fb8652a8f6e30fe54010
SHA512 22d8697257bdee581939c3a6de7a2b96e90990f9355afdaac6151062b69f84528019d31c01fda6bbd94247466aaba402208ec0a423501e760f5786f6f9022f3e
TLSH
T1A641075CA6ED1158B3B77F5AAFF6A47E487ABD372E06945D10110E4F0A22B40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download