Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/04/2026, 12:29

General

  • Target
    fpdf/doc/acceptpagebreak.htm
  • Size 1KB
  • Sample260422-ppb5rabw3s
  • SHA256 f09ff50cc6bc7be7dd1aa10f5fc765b56bcb7dbc3caa49876adb9bb7929595bf
  • MD5 SHA1 SHA512 TLSH
Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 13 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\fpdf\doc\acceptpagebreak.htm
    1⤵
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4464
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffbe21ec188,0x7ffbe21ec194,0x7ffbe21ec1a0
      2⤵
        PID:4732
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1776,i,15567159630938768016,4735910914128685957,262144 --field-trial-handle=2356,i,12501134522365647578,6317825347560440362,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
        2⤵
          PID:4708
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,10881773422750385671,14254409473433039086,524288 --field-trial-handle=2356,i,12501134522365647578,6317825347560440362,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:3
          2⤵
          • System Time Discovery
          PID:4768
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,1185073984194949538,8176064597746449570,524288 --field-trial-handle=2356,i,12501134522365647578,6317825347560440362,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
          2⤵
            PID:3776
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,14931111225041796154,7572441257197852926,2097152 --field-trial-handle=2356,i,12501134522365647578,6317825347560440362,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
            2⤵
              PID:5920
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,7606722092972835856,17157005407587815719,2097152 --field-trial-handle=2356,i,12501134522365647578,6317825347560440362,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
              2⤵
                PID:5452
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,678880062175377135,7157942696045747441,524288 --field-trial-handle=2356,i,12501134522365647578,6317825347560440362,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
                2⤵
                  PID:3692
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,10879939142454712019,12076187102594476382,524288 --field-trial-handle=2356,i,12501134522365647578,6317825347560440362,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:8
                  2⤵
                    PID:5252
                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,2805345009724549345,11159839071125240488,524288 --field-trial-handle=2356,i,12501134522365647578,6317825347560440362,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:8
                    2⤵
                      PID:5272
                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,2805345009724549345,11159839071125240488,524288 --field-trial-handle=2356,i,12501134522365647578,6317825347560440362,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:8
                      2⤵
                        PID:3884
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,16960919867020726819,7363130295782353700,524288 --field-trial-handle=2356,i,12501134522365647578,6317825347560440362,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
                        2⤵
                          PID:5316
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,14456875577542784490,1833574810951984246,524288 --field-trial-handle=2356,i,12501134522365647578,6317825347560440362,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
                          2⤵
                            PID:4224
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,312838987848100295,11458180303439468407,524288 --field-trial-handle=2356,i,12501134522365647578,6317825347560440362,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
                            2⤵
                              PID:1916
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,7909782507011576437,9352454045627641064,524288 --field-trial-handle=2356,i,12501134522365647578,6317825347560440362,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
                              2⤵
                                PID:2936
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,1828767536802477648,14270342796325226213,524288 --field-trial-handle=2356,i,12501134522365647578,6317825347560440362,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
                                2⤵
                                  PID:4080
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,1106141088077448983,8707668309538441143,524288 --field-trial-handle=2356,i,12501134522365647578,6317825347560440362,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
                                  2⤵
                                    PID:5100
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6188,i,8171245538983669084,16264621514973011720,262144 --field-trial-handle=2356,i,12501134522365647578,6317825347560440362,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:8
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3140
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,10198271217727034684,4556870906443119160,524288 --field-trial-handle=2356,i,12501134522365647578,6317825347560440362,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
                                    2⤵
                                      PID:5668
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                    1⤵
                                      PID:4836
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                      1⤵
                                        PID:1888

                                      Network

                                            MITRE ATT&CK Enterprise v16

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            manifest.json

                                            • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4464_1960305783\manifest.json
                                            • Size 177B
                                            • SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
                                            • MD5 SHA1 SHA512 TLSH

                                            manifest.json

                                            • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4464_498829917\manifest.json
                                            • Size 119B
                                            • SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
                                            • MD5 SHA1 SHA512 TLSH

                                            keys.json

                                            • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4464_601861173\keys.json
                                            • Size 8KB
                                            • SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                            manifest.json

                                            • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4464_601861173\manifest.json
                                            • Size 79B
                                            • SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
                                            • MD5 SHA1 SHA512 TLSH

                                            autofill_bypass_cache_forms.json

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
                                            • Size 161B
                                            • SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
                                            • MD5 SHA1 SHA512 TLSH

                                            edge_autofill_global_block_list.json

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
                                            • Size 6KB
                                            • SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                            v1FieldTypes.json

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
                                            • Size 509KB
                                            • SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                            settings.dat

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                            • Size 280B
                                            • SHA256 030978901609c12837a9b1afdcd1ee9f12ef19339fd94725f17a7cdb1e945f36
                                            • MD5 SHA1 SHA512 TLSH

                                            settings.dat

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                            • Size 280B
                                            • SHA256 827caedd6ba67a465e2378da508ebf9f7e5dc38b9ff3d1086fe8a0b10ad23634
                                            • MD5 SHA1 SHA512 TLSH

                                            BookmarkMergedSurfaceOrdering

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                            • Size 6B
                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                            • MD5 SHA1 SHA512

                                            BrowsingTopicsState

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                            • Size 414B
                                            • SHA256 099210224948ec37a02766fcc6dcd6aab0d96bd5435c01f2d1c833a5040aa792
                                            • MD5 SHA1 SHA512 TLSH

                                            SiteList-Enterprise.json

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                            • Size 2B
                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                            • MD5 SHA1 SHA512

                                            HubApps

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                            • Size 106KB
                                            • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                            Network Persistent State

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                            • Size 2KB
                                            • SHA256 0b32fb34cf625fd71364243af59b14bdb22d3c3d90e7c5fd89dc21027805c189
                                            • MD5 SHA1 SHA512 TLSH

                                            SCT Auditing Pending Reports

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                            • Size 2B
                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                            • MD5 SHA1 SHA512

                                            Sdch Dictionaries

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                            • Size 40B
                                            • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                            • MD5 SHA1 SHA512

                                            Preferences

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                            • Size 16KB
                                            • SHA256 f78eb31be3a84c3047a9739d18a41cc00b809b11518d0ef310f157907202cd82
                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                            Preferences

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                            • Size 15KB
                                            • SHA256 c21def4404141bedd70f963b0fdf4149055efde646e822fec472029ac5dffdcc
                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                            Secure Preferences

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                            • Size 35KB
                                            • SHA256 df7f0aa83b9be2057ffaf51443962e8e5c5e489f4dd620c6362df86140b43a5b
                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                            sync_diagnostic.log

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                            • Size 23KB
                                            • SHA256 8cc35c854dd5be65c03ff448e335c43034bd81e32fee908af95f7ebd8ffea7ac
                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                            CURRENT

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
                                            • Size 16B
                                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                            • MD5 SHA1 SHA512

                                            MANIFEST-000001

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
                                            • Size 41B
                                            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                            • MD5 SHA1 SHA512

                                            Local State

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                            • Size 26KB
                                            • SHA256 2fe909274d3b7729f88293a97ad83655b4a985449ab75b2e2d8d9aaddfcc58b0
                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                            Local State

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                            • Size 27KB
                                            • SHA256 c414e76557fc8c14666171aeff49ceeab3552200ba36216032e0f36752b7c261
                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                            Local State

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                            • Size 27KB
                                            • SHA256 751cae89fcd2736d4826142ffbfb1e56df937ac4f16fa4beb234939958ac9a54
                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                            Local State

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                            • Size 27KB
                                            • SHA256 5ba805a093222a76a3faf64df2ef03cf4f36750b789f94e496eb571a5efefd04
                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                            Local State

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                            • Size 27KB
                                            • SHA256 e2022b39850d02afe0d2d26eecf22e9eccd37f6930be80e244e8575e333d693a
                                            • MD5 SHA1 SHA512 SSDEEP TLSH

                                            metadata.json

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                            • Size 1KB
                                            • SHA256 65f5cbf1be31936b1103e00122a60bb3ba7462d8832ac1f484dd6865116eeb10
                                            • MD5 SHA1 SHA512 TLSH

                                            metadata.json

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                            • Size 1KB
                                            • SHA256 001a514c5a151516deebe6de244695d35b5a8321d530ea4b4a75c4e0b4756914
                                            • MD5 SHA1 SHA512 TLSH

                                            metadata.json

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                            • Size 1KB
                                            • SHA256 ac5cc6b52f1104c0da7c710e41adc834bde19c5dfbf04f5cb47c3666b2e13aef
                                            • MD5 SHA1 SHA512 TLSH

                                            5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

                                            • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                            • Size 2KB
                                            • SHA256 51611d70ff3f4a359760cb7e04465b232dffb9d8f5dae8fe32383931dda7e2d2
                                            • MD5 SHA1 SHA512 TLSH