Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250619-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250619-enlocale:en-usos:windows10-ltsc_2021-x64system
  • submitted
    02/07/2025, 19:25

General

  • Target

    Seliware/bin/Monaco/index.html

  • Size

    164KB

  • MD5

    001dcbb8f41cdcbf9b4d1e3a0ed4b2d2

  • SHA1

    982a05814546017c40771e59e7677b53d84787e9

  • SHA256

    f1d2c52f2803c29585b81d2eff74c56242d27e9619ee6d38081d5604c5bb1951

  • SHA512

    9a4eba2a9314b6f5851997e1db0ecfae8e40da3443d8a5f9df933ccf6a4d75fc330888c8d14818326e15b3dec9ae2f5f7e73cd08c3822dd7eb0b2d753c8cd8fa

  • SSDEEP

    3072:Nk4J09UmmJv8kBpZaFD48VOAGUWYPjDZlLJbRBiPEP8yKUz2Ojmjr8zM3KP7pblM:64J09BA3pZaFD48VOAGUWYPjdlLJbRBS

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Drops file in Windows directory 20 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Seliware\bin\Monaco\index.html
    1⤵
    • Drops file in Windows directory
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4748
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x35c,0x7ffdc9fef208,0x7ffdc9fef214,0x7ffdc9fef220
      2⤵
        PID:2132
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1808,i,1704106727605097053,833663958265322522,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
        2⤵
          PID:2944
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2268,i,1704106727605097053,833663958265322522,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
          2⤵
            PID:2336
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2312,i,1704106727605097053,833663958265322522,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:8
            2⤵
              PID:5612
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3488,i,1704106727605097053,833663958265322522,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
              2⤵
                PID:1068
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3492,i,1704106727605097053,833663958265322522,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
                2⤵
                  PID:324
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4868,i,1704106727605097053,833663958265322522,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:8
                  2⤵
                    PID:948
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5056,i,1704106727605097053,833663958265322522,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:8
                    2⤵
                      PID:252
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5616,i,1704106727605097053,833663958265322522,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
                      2⤵
                        PID:2284
                      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5800,i,1704106727605097053,833663958265322522,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
                        2⤵
                          PID:5564
                        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5800,i,1704106727605097053,833663958265322522,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
                          2⤵
                            PID:5260
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6132,i,1704106727605097053,833663958265322522,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
                            2⤵
                              PID:2584
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6124,i,1704106727605097053,833663958265322522,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
                              2⤵
                                PID:2920
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5624,i,1704106727605097053,833663958265322522,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
                                2⤵
                                  PID:2984
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5440,i,1704106727605097053,833663958265322522,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
                                  2⤵
                                    PID:2196
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5272,i,1704106727605097053,833663958265322522,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
                                    2⤵
                                      PID:5532
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=888,i,1704106727605097053,833663958265322522,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
                                      2⤵
                                        PID:732
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5852,i,1704106727605097053,833663958265322522,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
                                        2⤵
                                          PID:4420
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5312,i,1704106727605097053,833663958265322522,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
                                          2⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:4332
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5452,i,1704106727605097053,833663958265322522,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
                                          2⤵
                                            PID:964
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                          1⤵
                                            PID:1100
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                            1⤵
                                              PID:2728
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                2⤵
                                                  PID:5920

                                              Network

                                                    MITRE ATT&CK Enterprise v16

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      280B

                                                      MD5

                                                      36d6ddd51958f3cf4471399f17b732f9

                                                      SHA1

                                                      c764cc33136fedd44be4733f72ff3ac2a70face2

                                                      SHA256

                                                      ba14232f9cb19f4bf76d1ae7b04df64817f102a5bafd6b482eb3a00888bfc322

                                                      SHA512

                                                      43b23dd088f52f2570efc6bb3d73c4436eec15a344674e86d640bbf32825e77809a50a3aa2c29902481d4d51a3e420efc66716d1afafcb69c27e44fcc0b5a5db

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

                                                      Filesize

                                                      2B

                                                      MD5

                                                      99914b932bd37a50b983c5e7c90ae93b

                                                      SHA1

                                                      bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                      SHA256

                                                      44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                      SHA512

                                                      27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

                                                      Filesize

                                                      108KB

                                                      MD5

                                                      06d55006c2dec078a94558b85ae01aef

                                                      SHA1

                                                      6a9b33e794b38153f67d433b30ac2a7cf66761e6

                                                      SHA256

                                                      088bb586f79dd99c5311d14e1560bbe0bb56225a1b4432727d2183341c762bcd

                                                      SHA512

                                                      ec190652af9c213ccbb823e69c21d769c64e3b9bae27bea97503c352163bf70f93c67cebbf327bfc73bfd632c9a3ae57283b6e4019af04750fe18a2410a68e60

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      82adb2dd8a136a0781ec050a145fcd58

                                                      SHA1

                                                      01d653c936339f4f4508cd97f9f54da6316a1bcb

                                                      SHA256

                                                      cbb27eb2c6f21ba18689a195fc68cc1b17223fa18c41d7af49e21f97850a7d93

                                                      SHA512

                                                      f67024251adde60b465092b23f3b1d4d8f692f53421c1250030fadf0099387b1b5074478786f5815027acbcdbe309fd3501354e9a2a9333f4ae1e369e39fc19a

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

                                                      Filesize

                                                      2B

                                                      MD5

                                                      d751713988987e9331980363e24189ce

                                                      SHA1

                                                      97d170e1550eee4afc0af065b78cda302a97674c

                                                      SHA256

                                                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                      SHA512

                                                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

                                                      Filesize

                                                      40B

                                                      MD5

                                                      20d4b8fa017a12a108c87f540836e250

                                                      SHA1

                                                      1ac617fac131262b6d3ce1f52f5907e31d5f6f00

                                                      SHA256

                                                      6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

                                                      SHA512

                                                      507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      15KB

                                                      MD5

                                                      878c51a7140ac3b8608b2c1fecc7f453

                                                      SHA1

                                                      35b0c4f639cce1097eaa9044a108225e7cf596d9

                                                      SHA256

                                                      5b72d3e57fd31cf42c1215a92eb4bccb43d80659dc3f96030ff420616f51c54a

                                                      SHA512

                                                      13896da2220b44875328a9cac25aae965c2fde046cd0e57ace8b1747126f099ba1554b2e269918623df9fe15a9fdeeabad2e3d8d2d959971065688e3c5a95257

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      15KB

                                                      MD5

                                                      c0eec30c2dc8d65d8b4c4028650d0b72

                                                      SHA1

                                                      172080403613538e58f54f68abf629c77c5a2df3

                                                      SHA256

                                                      c76fe26e15382f07f8399d474ec17f5d44ce3da970089997ac5aa3d30c9bd1bb

                                                      SHA512

                                                      8530796c7641b8ce7d3cce339ba2205e134ac4c1319041d4eca04be48c9a45915fd54faab4ce1e425b43d4f6eee195f645652f6469f88c0bc6d2886d3f64e0bd

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                      Filesize

                                                      36KB

                                                      MD5

                                                      e5c4f3f95afe7b2e64e960cb427801c8

                                                      SHA1

                                                      ec69573872dc62d895f7fdbd41a9476146db3f49

                                                      SHA256

                                                      fea499c65d17eef14b246b07d234dd30004177940a145960229ec2c3a5b94142

                                                      SHA512

                                                      ea5c7bfc218ef520a78da06dfe876bf3eac2342ef3a4b7a8a6c50399ef46707f9bf964131ce7070da61ad6b3bf1b1403c0a1243871ec4cdd5b1b88b3ed222935

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

                                                      Filesize

                                                      21KB

                                                      MD5

                                                      0017ddbde953f1512d99574254884973

                                                      SHA1

                                                      1f405d39aedb90c18bd23bf1dd305c954422b335

                                                      SHA256

                                                      c65dd68141ee927bd1d045e3470eea109c29e9436bcbc64a2b8cd61c13f048b0

                                                      SHA512

                                                      8089a354efce0324c4db899ff96d8cad3536aa94c30957c9ca060b296347cff6f8aaa3bc7cade1f1d6e934666821714a63e4f07d23739361a0275aa58d184b10

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

                                                      Filesize

                                                      462B

                                                      MD5

                                                      2069b737ca415eff6454a252fc67a4c1

                                                      SHA1

                                                      03a6b3c615b2dcba0f100277d35efc21ee79dc08

                                                      SHA256

                                                      38b672f1647a139784161b36a03f4f7f7a74281d0e0bee848c89a833441dce48

                                                      SHA512

                                                      8be6ed7b1dcbc10bed95af47e52f764696e495cec13146dde9d4838400415d4811a78090e4477916d5db9d3d20f6f140e57b5248dc487431c97a4c4c38570d29

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      38KB

                                                      MD5

                                                      ff9cffb2d1410084f652e5340950f2df

                                                      SHA1

                                                      b72e9bc299612cea0c381f25b924bab095e43876

                                                      SHA256

                                                      c05243424303992a009289c175d81e876579ceb5c4c3951faa8e07fba70a9ca7

                                                      SHA512

                                                      8ff7442f4cff96230c777d85ac1938d907f73a531e73a5f2e8b30b2f5c8d8a1370dea1823f66d34d67e830d06a9e16899786c6da7346c1a06ec62a2fbc59e1b0

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      45KB

                                                      MD5

                                                      8738fe0511b1f648aeecfca0113c1712

                                                      SHA1

                                                      28119ca05a5df58f6ff1993115189c1f48c2d0fc

                                                      SHA256

                                                      ea68ad9d5e7efc92662fa32a8b9407a56531c97a945976d0fc0d7283ba23faab

                                                      SHA512

                                                      69fb47f933055c3bf6c599157324fd7218f8296e62eae6c8a407139a804ec8cca2d863465ee1f31c9451722540ebcb2088bd331ab66e956d3a9781856e6925ca

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      45KB

                                                      MD5

                                                      dbf3aad50ca17ddb2db2e34c665c8ca4

                                                      SHA1

                                                      8ac78e4d105848304bb4443a860dae0b3d32965f

                                                      SHA256

                                                      be6e1bb53e8ca12b63d532897a40ab6a1ce476676b00d27cee70b3a0c2402544

                                                      SHA512

                                                      a1065bef27d03f0741d7b958d7c90e32d5b9f48f3104242f1a5117c04dbf2790e8c3b8ea93ee3c595c469b945ec3948473becb8a37dcfd5c6c1d9faf053d8aba

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      45KB

                                                      MD5

                                                      2e3a3fd751b51d0417b1642406104396

                                                      SHA1

                                                      38a9b09777ee3e599ebaef52b929a9df37978fcd

                                                      SHA256

                                                      a5ddc1926fba7b39c097aea380195f830910a811a3a8579ca6035178d42ea1ec

                                                      SHA512

                                                      132653a3b5bd0d8fc8ae8c16a77cb9af064e3e28ca2bae03b2f7bbc49e6fdfbc15766a37c6d26965fc431309dc973e47ef8472c0608d0e91318eb52b92535345

                                                    • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      9118725ba511485e718507f5a261e01a

                                                      SHA1

                                                      62e0c7768a33ae6d569285d3c9ccd48a5117a938

                                                      SHA256

                                                      e696168327d97c4205500e8f0071a1e983a790b4bd1abd4cc76266662c5df0a4

                                                      SHA512

                                                      9c1113e1fca7b3616497f512971f77ea6e0f6930314c46034ff4392773cd47992fe33f3a2d7972d166ad2d5dd4bd06f162fe81703b185c486633a394b3a51366