bcf8b699d72997989db485f43f08735b17ba3944d953d95e51e0db1751124354

Analysis

user interaction
yes
max time kernel
598s
max time network
597s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/06/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno.exe
Size 164KB
Sample260604-tsk92sax9w
SHA256 bcf8b699d72997989db485f43f08735b17ba3944d953d95e51e0db1751124354
MD5 5434fc912d95540ff0ad64b62af4eed1
SHA1 6e722a373e3db614072336040a4c9ce4e944e121
SHA512 8762acb9e3b22932a2992e8bf6406b254bccc0ba033eaad15705ab5194ebf1c7bb14bf96d6207795110e102d3fd6a3db5950f2b4562b447f6875d66afeb1ed15
SSDEEP 3072:p20jWfVKLer5haSpfO9D/y7jXEkemZA4nsSyU3HZLVV:cIVSpfO9jkS44UFVV
TLSH
T165F34B07A6A850BEE1B7D679C9924941FB723C594B71A6CF03507AB60F737D0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2428	msedge.exe
5448	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134250636158455588"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{CF6578F6-D9C1-44D2-943E-359D2832EB12}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{DADD0CCE-39F5-44F8-B12A-F3EE337A3401}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3332	msedge.exe
3332	msedge.exe
5496	msedge.exe
5496	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 1048	3520	msedge.exe	94
PID 1048 wrote to memory of 3304	1048	msedge.exe	95
PID 1048 wrote to memory of 3436	1048	msedge.exe	97
PID 1048 wrote to memory of 2428	1048	msedge.exe	96
PID 1048 wrote to memory of 3436	1048	msedge.exe	97
PID 1048 wrote to memory of 3436	1048	msedge.exe	97
PID 1048 wrote to memory of 2072	1048	msedge.exe	98
PID 1048 wrote to memory of 2072	1048	msedge.exe	98
PID 1048 wrote to memory of 5480	1048	msedge.exe	100
PID 1048 wrote to memory of 5480	1048	msedge.exe	100
PID 1048 wrote to memory of 5480	1048	msedge.exe	100
PID 1048 wrote to memory of 5252	1048	msedge.exe	101
PID 1048 wrote to memory of 5252	1048	msedge.exe	101
PID 1048 wrote to memory of 5252	1048	msedge.exe	101
PID 1048 wrote to memory of 4492	1048	msedge.exe	110
PID 1048 wrote to memory of 3820	1048	msedge.exe	111
PID 1048 wrote to memory of 4492	1048	msedge.exe	110
PID 1048 wrote to memory of 3820	1048	msedge.exe	111
PID 1048 wrote to memory of 5276	1048	msedge.exe	113
PID 1048 wrote to memory of 5816	1048	msedge.exe	119
PID 1048 wrote to memory of 5816	1048	msedge.exe	119
PID 1048 wrote to memory of 5816	1048	msedge.exe	119
PID 1048 wrote to memory of 1620	1048	msedge.exe	120
PID 1048 wrote to memory of 1620	1048	msedge.exe	120
PID 1048 wrote to memory of 1620	1048	msedge.exe	120
PID 1048 wrote to memory of 3336	1048	msedge.exe	121
PID 1048 wrote to memory of 3336	1048	msedge.exe	121
PID 1048 wrote to memory of 3336	1048	msedge.exe	121
PID 1048 wrote to memory of 2488	1048	msedge.exe	122
PID 1048 wrote to memory of 556	1048	msedge.exe	123
PID 1048 wrote to memory of 3856	1048	msedge.exe	124
PID 1048 wrote to memory of 3332	1048	msedge.exe	126
PID 3332 wrote to memory of 2596	3332	msedge.exe	127
PID 3332 wrote to memory of 5448	3332	msedge.exe	128
PID 3332 wrote to memory of 5780	3332	msedge.exe	129
PID 3332 wrote to memory of 5780	3332	msedge.exe	129
PID 3332 wrote to memory of 5780	3332	msedge.exe	129
PID 3332 wrote to memory of 2876	3332	msedge.exe	130
PID 3332 wrote to memory of 2876	3332	msedge.exe	130
PID 3332 wrote to memory of 612	3332	msedge.exe	134
PID 3332 wrote to memory of 3000	3332	msedge.exe	135
PID 3332 wrote to memory of 5892	3332	msedge.exe	136
PID 3332 wrote to memory of 5084	3332	msedge.exe	137
PID 3332 wrote to memory of 5496	3332	msedge.exe	138
PID 3332 wrote to memory of 2952	3332	msedge.exe	139
PID 3332 wrote to memory of 2952	3332	msedge.exe	139
PID 3332 wrote to memory of 4788	3332	msedge.exe	143
PID 3332 wrote to memory of 4788	3332	msedge.exe	143

C:\Users\Admin\AppData\Local\Temp\Xeno.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno.exe"
1⤵
PID:4896

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\UnblockConfirm.htm
1⤵
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Users\Admin\Desktop\UnblockConfirm.htm
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x268,0x7ffdf6c1c188,0x7ffdf6c1c194,0x7ffdf6c1c1a0
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,15566287738817465264,12699704351649285113,524288 --field-trial-handle=2280,i,15938938881646444397,5686754630293691334,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,15686030763265981135,15473063393626905121,262144 --field-trial-handle=2280,i,15938938881646444397,5686754630293691334,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
    3⤵
    PID:3436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,13340618503980742320,10691371405274596196,524288 --field-trial-handle=2280,i,15938938881646444397,5686754630293691334,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,15142045109106344321,2034256414480773392,2097152 --field-trial-handle=2280,i,15938938881646444397,5686754630293691334,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,14206037251396502528,17122119048580548785,2097152 --field-trial-handle=2280,i,15938938881646444397,5686754630293691334,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,7623162936995504509,8841820144274366554,524288 --field-trial-handle=2280,i,15938938881646444397,5686754630293691334,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
    3⤵
    PID:4492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,5424282744577238004,9565842343053011390,524288 --field-trial-handle=2280,i,15938938881646444397,5686754630293691334,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
    3⤵
    PID:3820
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,3739889001592091775,17314436108466703596,524288 --field-trial-handle=2280,i,15938938881646444397,5686754630293691334,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
    3⤵
    PID:2104
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,3739889001592091775,17314436108466703596,524288 --field-trial-handle=2280,i,15938938881646444397,5686754630293691334,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
    3⤵
    PID:5276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6040,i,2263625903922422262,3662050597294562727,2097152 --field-trial-handle=2280,i,15938938881646444397,5686754630293691334,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3432,i,18006507511965017211,16775640316140088306,2097152 --field-trial-handle=2280,i,15938938881646444397,5686754630293691334,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
    3⤵
    PID:1620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3500,i,16750284024881413888,3938089843646535973,2097152 --field-trial-handle=2280,i,15938938881646444397,5686754630293691334,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=556,i,6078343683152807564,6038144246015772236,524288 --field-trial-handle=2280,i,15938938881646444397,5686754630293691334,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:8
    3⤵
    PID:2488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,1973124693773645511,985581406709330890,524288 --field-trial-handle=2280,i,15938938881646444397,5686754630293691334,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
    3⤵
    PID:556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,6543505227590651659,14557092486402309774,524288 --field-trial-handle=2280,i,15938938881646444397,5686754630293691334,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:8
    3⤵
    PID:3856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x25c,0x7ffdf6c1c188,0x7ffdf6c1c194,0x7ffdf6c1c1a0
      4⤵
      PID:2596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,2900427043429677460,1442838202135237173,524288 --field-trial-handle=2296,i,6995098257232031599,17789193607449406780,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
      4⤵
      System Time Discovery
      PID:5448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,17845037968541456301,9762792010841027122,262144 --field-trial-handle=2296,i,6995098257232031599,17789193607449406780,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
      4⤵
      PID:5780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,16080848525824599490,14943954099037448748,524288 --field-trial-handle=2296,i,6995098257232031599,17789193607449406780,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:8
      4⤵
      PID:2876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,12962413113392050975,8908375262125421948,524288 --field-trial-handle=2296,i,6995098257232031599,17789193607449406780,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
      4⤵
      PID:6068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,12962413113392050975,8908375262125421948,524288 --field-trial-handle=2296,i,6995098257232031599,17789193607449406780,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
      4⤵
      PID:612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,1204433904802047296,1665234623965497838,524288 --field-trial-handle=2296,i,6995098257232031599,17789193607449406780,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
      4⤵
      PID:3000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,6705411334590613552,15547210926488239179,524288 --field-trial-handle=2296,i,6995098257232031599,17789193607449406780,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:8
      4⤵
      PID:5892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,5943304238076368723,1761452621249304064,524288 --field-trial-handle=2296,i,6995098257232031599,17789193607449406780,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
      4⤵
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2828,i,4452961625355521902,6053794045659789166,262144 --field-trial-handle=2296,i,6995098257232031599,17789193607449406780,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1520,i,11069918660304756667,12743589308823325458,524288 --field-trial-handle=2296,i,6995098257232031599,17789193607449406780,262144 --variations-seed-version --mojo-platform-channel-handle=1020 /prefetch:8
      4⤵
      PID:2952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1520,i,14995919080918213580,2391222946976318032,524288 --field-trial-handle=2296,i,6995098257232031599,17789193607449406780,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
      4⤵
      PID:4788

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4676

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5bfbbfb9-fd65-42cb-8709-04cc97ea3e23.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5bfbbfb9-fd65-42cb-8709-04cc97ea3e23.tmp
Size 26KB
SHA256 7e215f3985538a4522b0db1cfa7ebf52010d79797aecb5d4f5a695e2c885a45d
MD5 27c861dcad559dc7a561c2c2c1b5159d
SHA1 b8af729bfd19f93bedb5255521f49516c91c987d
SHA512 76acc73a350a76e6e9eecf925150fa012f3d098a17ecf879beb20b9f84e20aeed80cbe4aa35bbf3ef8d0d5bf074c318349faa6647a47f35b02f16ad464b49794
SSDEEP 384:nlriF9CcmyWCBsN88TUNTUlI4IQckCr05iphiftGm3p9JLZaiHe4KV8p03LBty/n:YFccpBhwgJkJsoGm3p9faiHI8p03Ls
TLSH
T1F2C25B36E868CABBEDE74B99B74A3903DEE4416386CC9AD4D6DC5E0C00971DD430BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 bf288bb8441d7d5245e88b116d1ae8e0e1e783a3368a11b11fefc23ba4a51d08
MD5 38f1997ad200b1e2f2fe721345ed1891
SHA1 bec507f847e497b9cdf60c5b9d7f135de0fb417d
SHA512 c07f4e9ff3b589704a413f4f375d02ebee4de76fc156f8d1aea309a3daaab028cfa81020fa4d3782c3d0d7a578887935b11641065a22b696bbb672dcb3f47592
TLSH
T1BBE0D8C409C6D2AEB544788743D5A70C9382360FD2C46A9A7720C4C5704288463E1570
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 20f1834ff39b7fce57d6bf2bfbf18157152b1114c751044fefa4f45edf1dd06d
MD5 bd0fdd9aaea96db185718737402dcd20
SHA1 e2fb5829b7ecea4fef7ba95462b2ff7c388ce2bb
SHA512 4608bea30ab79fbf71a7d07c87856ad92b39f1a3bfa48443ee21cb40e3e94396d7f0b78893244cb62762e94eafe10bb5b1eced23d494f36f3c8c05f98e008207
TLSH
T194F0F4B6C921EC2718FD0B6870594B4AE75013272780989F3B3C930C8FB463B469985C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 69b81a5f233e726485ec06380173b587bc4762475743c44c3338fd0f2757b2d1
MD5 9c14876f5ae6db0b3f5a5afa70bb01b3
SHA1 1413ea10676c234334cad3c41deb9e4c39e81dee
SHA512 cfde5a2c8b73b526543e1ca348dc030362b25d7776b0a23121cb4a268840587a9cdd4bf3ee2062cf45a8c980c2e8a7427d18380afe43e1ae639baf9924622df2
SSDEEP 768:JSBesmxVxrJPPpA7It5MvPxwDxAjweY4Zk:QBCxVxtPPp3vEOew/4Zk
TLSH
T10D1390BEBA4A9CA1EACA5C7D480B0A32237DD971FCD14303777131865F7630AA97E941
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 84135ab75b9d0a4951c1d89610b6677e40af98b11a8740778a4c9acc88aca2f9
MD5 c7bb908a9e25950490c8234d550411b7
SHA1 cf993c2a0cc85d250c7ccd372d4f8aac6762e9e8
SHA512 fc9a5c2096bf36fa6e59b959ebd53e1f09235c82ae84fdfdb2051d1806d4a7f9519d3c8bdedbcd3975362a311344bd405df82381904c6074b97704f327d28769
SSDEEP 1536:h4L/cl5L/G19eiPFnQDqDLL/C8L/6kWhL/HjDYmX55mWQJmy7aej7q1czky:eL/uL/hiPFRnL/PL/CL/5mWQlF3Gy
TLSH
T1F5445EF70941A05BCBA802F5E2033A3ED17B055D7CE1F9E9E5784CD52825B22B6BDE84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 ec9915c9bd454a2793c41c74cd298fbc345915e7b5b9f6a7cb55e6c14f5ae659
MD5 1a5b760f23eb70b8b4eb83c5b5c9bc95
SHA1 9314f5783b5aa1dae31bad7b62e83c90eac2650e
SHA512 0beec5cfc1280447c31ea12d1d52387b53e949e707d8f756b26b2b7f427321e99eef628476db093f436524576af189a2cb6911ed8d330d73033fa30d25a9e6f3
SSDEEP 24576:VYIollXdYmkVoA59FLLlPygYWAM9PJhe49JDs6uYYePgvVwlBVY+NeL+:VY1CmkVLlPTY+Py49NsIYeI6VBU+
TLSH
T1EB867DEDCA6898C3CD639970B0F0ED477C7413C3F995C1D68898C684026B7C5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e21fb99649932acde1de1d5b46a9ec0c0c860d6b5d203c12ce7d6f4a8505ffa8
MD5 2c996c1050d224c5fd6dff91653477d2
SHA1 984c41bcbda7f9c0a7af726b637448cca9cbff1a
SHA512 2430123d1633fdc3b6c2be15c5c321056397356844feb72ad06ead2ee921cba177114b758e99f674dbd3f2617c82ca7ed58c4ad88e5d8074914642b368fdbf2b
TLSH
T16981EA30091291A3D393893181E85624347289E9FDD3EE9E21901CF6FCFAF73857B956
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 a08a35b271dc3cb2489a16a6e45a3ab8338be49b0a383ba02d71fda83557840a
MD5 ff37d307bc753c63cf9bc0c1e0a29be9
SHA1 a970c0ded87fa0c358393de2518842a987206b9a
SHA512 ea70f8254f26bbd34e888ed0f0c174b20144d214e4051169226406b5ba66569aafb5152642f089c1807357cbcbba72902dedd47dc391c54391c7ad3deb77c66e
SSDEEP 3:MsEllllkEthXllkl2zEklXT1/:/M/xT02znx/
TLSH
T1634404457FC00C1DC50010304011C3700370FC54051DD74734510413DCD55404C05004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 b3beb86ef5c362e257de9c51819f44e38bda5f5d1f43e54a618e8e69dd83ebd1
MD5 9ab8832c9febb3e0451fb205436ea034
SHA1 56048e526bf707546c39eb7ac5a4e320a9e24f12
SHA512 62d4db71b2fd0ce20e8ca8bda5981132dab0ff665beb8395d4bc9b74186ba16c2fbce1b7152c7b37e734887a68c4ea22d85ce14beb5afc5c5daf82d2bf36e604
TLSH
T180E0D8D969C7D1EE655438C682246F0CD1D0344AEE866D47670098C07E43001F649567
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 1d7846d21a1418564c8c1593637bbf5ef3a91743b34e23345af536e69d68461a
MD5 4ac6b66c84849cfe76b45cbcbd2e442b
SHA1 5174a21f313cf7f82d0e0a969cc7aa577ade9ed3
SHA512 de6919999cd9809876a1acbb0e0b279412eaf1b381cc6be9a1f9db153169763bf95d58917b1dd9851b8aac001a3931e170b82b841f904cc50145c0e5d2f09be2
SSDEEP 48:Tyi+7f+UZD4jJ/BP7wpWxlfCKFOswgTpz:GLnD4jJ/lwpYf7OmTpz
TLSH
T1F2E2CE8D3B11F511C8ED733EA0C2C5E05EBC697C864D7170913898728D62A65F8AF50A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 843c70691783e67495edece2daf14ad87cf90e3308d95e01ead4cf6c08cbe1d6
MD5 2169accc9b48cefd3525179b79f8e8c7
SHA1 6a74f7c1a50e5101ceebad900262f4ab543b0e09
SHA512 57b5fbe789a01fa6fe211154eacee94bd612b1932139d93c98be0e92b98ab5d2328e72f9af4ad128678d1857b80d76b5c5eefd2309b0b8b84b44835bc7651641
TLSH
T11FE020C447C9D1FB715D7CD7467C674D87F0384FA38C3D85B7098881B101541E249174
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 0b8342d4c7ccefbbb5303010bddc97469eb637776eb261de1832029262871391
MD5 1d42d6b2db854acd0f12e4c1ccdcbcdb
SHA1 bba35a7c42401b4b203a1a6accc982376a86e104
SHA512 398b17487fff77adec68a7092205479afe5d35d38271e54b1ae44771e2ae620ec8ab00594d9ec78ed3c7a038d8da38f4d3a70f021d749c9eb573129485c5f65d
SSDEEP 96:nBIU+bGz83uy3+u4tgp4DLjGQLBze9z3WOjBHMsDEuspU0wbtqrOQpPfR4J+MCXD:nBf+G83uy3Ct7XBBKSqH7DXspU3iV
TLSH
T16214014E5F343721CDBD917669E744B35D7CF03F8B1266CA686114B4CEE2A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 f5186fbcef1d52f28c3d7f1512113f63cd3765c42106f843807fa25b05daf47d
MD5 e0bb8ed226abd567716e03a260bd4583
SHA1 03ab22f1fdb1da7957addbfd343fa2f4494effbe
SHA512 d8a1ea1c98211acbe89fa5128bc6e910ae3cec65e85832a175964cf92fc1e39e5c020f0619885520e0df1de4c15cad7101268e0bb97e699c12207911e09a39dc
TLSH
T118E020E5A4CED5FF7649208B421C7F0CC7F0740ED7897F4ABB059842B405148A3DA1E1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 7f219023e96e23bd91f0b9ef7d87b62ec8f5ab4e330a1780e15efd39ca1eb39e
MD5 0bde2f6c444cba92b85a50ee7e2c28ee
SHA1 081d5ada3fddf195cd83f51dd68305b48c0cfe91
SHA512 fe41efab2e0a56bce14741bc76db94eab98b27f5f61608cd726886634ed870e75ddcf16681bac0a2eaa0380c635a0501c91c5d37da3ba20a29adb96ea4493208
SSDEEP 24:TL68LbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T2SLopFMatSaw/auUOt8B
TLSH
T10E928C4E5F346220C0F04B36EDD189672F7C211CD3A72A99DE5410F3DE9259BF1055AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 06d602ed7816c8427637714ec5c27368b8c0aaf582e1988a4a1d7054c0723fac
MD5 8bd6174d40e0d7113da66ead0069f1d0
SHA1 9fbfc727e48b1ac0a81177c213a84e8c48943634
SHA512 027cd9a935e01ee93d464924d44cf2bfafaad614c56258ba5cfe24fe0144b7feb990aef6b2b08928c6c5668e20aa0c1617040d9a7585423dcb4ced255b88a5cb
TLSH
T10031BEF783B485AE8A1096F0BA18AE2FDE2D0510436C3D9A85E0AE1793E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f5adfe571923666f615143da3682809265dd2c1cfae5b9839d8e86546b69c5bb
MD5 930544c79a7f28cfc3aa561bd7ba3a1a
SHA1 c7d73d0855987d531c56bd0c5a3ba6a94ecf653c
SHA512 45854921ed6802a8f233286f59f5ceb92449411a87310c15759894ceaef738763ce312703764d21c799515c0b826f87d4f5e18536eac8b476ca6ac73c7b4d5d2
SSDEEP 192:sxZgRc7yMqZjK1Ml8GiA/f0s8WpVU1ZdIaRuvkzodpHLaHFS6+WNXXc/YPvSKOIe:sxZgaSWA/f0s8WvU1zIKYXeHR8/n7US5
TLSH
T1CD72E806AA24497B8DD7D219FA457F53D6F90163E2905E449AFC8F1C01E7BED220386F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 dd5b86e55bf6f33e83f2bacb993ef63c9506c039cd9728a18093365548faa71f
MD5 7434a0a274bc40ab8b5389d0c7579cf5
SHA1 cd9f176b50bc8588ec58f0dea6de92205515fa67
SHA512 8a05fa37d8ee1068735598261a6a999ae0cdb04d3ccc0deb9a518aac83e96aa32d3202235cc954f4fa9a54391b407b1c577c04928ec65203cb4057d0d4a3789b
SSDEEP 192:sxZgRc7yMqZjK1Ml8MjA/f0ss87aZdIaRuvkzodpHxHW6+WNGYvICSoYIgjXJ:sxZgaS7A/f0ss87azIKYXRHbGRTj5
TLSH
T19362F9066A3459778DDBD219FA457F53D6F91163A2944E44AAFCCB0C04E7BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 b82cb093b569b72b72ecbfaa8ab5dc09407264e172689ba436b4754856be58cf
MD5 cb07d4ad9c2432ef7aa33701fb7d7160
SHA1 f39c8c7851bb30237f9f9c52999ea8a979632315
SHA512 fb79e182b35aff060836c6ca8669c1a02d03352c05bc67fb8d519952e9db415828ab8d0ddbe0d7a0ab2f37575b5dd17b558bebfdd0dd7576486434ed3356a1bb
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9ysy10LlC:eY8Od/HEnFhWvFvmXu1jaRt10Lm2NuOC
TLSH
T1E9F2FB3B6C0CCB7E4F844E9CEC2A7F8A6DE801CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 f41a2eb045c3ab8fa5b9dd16cf583fd6bbc4488a217d1eea15e58d70bd698309
MD5 2fbe9add403c32ab85e488eb20ff2b80
SHA1 0a2a2ea3730f344b0acf3c5b1349a111cd5b87a8
SHA512 929ec0bf9973a029556ae699bb1a6d0a64f7b18d36da87fa9a0ba40eb3879a8db6b719b9fb42f4985ca895f9990f84f80a48a7da6667e45ed337b8fab5ad8255
TLSH
T154E0DF9045CAE1FB705D64D30A28A70D82F4B40FD3C83D467F21A8406543504B19A1B0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 0f3ba3a0df64a375a62cbb55065a2879c1db6f90eb85097a5ce1fc92384a951d
MD5 eed10249935d6914cdeeaab87872ebdd
SHA1 09101f8a800428e95cdde36deea9f9a03642c680
SHA512 52d24f93023c24ba2deecfd4a8a2539f2b34b3198c3d9a7d13f59c6d3f31a78e14209860e5073503cd67b9ee85d8dee54c919034a155bffb2ef0b275423840c8
TLSH
T181B0128477107219C0870DF14E90C7446621F00311014D03CD58CF258D695FC2F969D3
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 c8792bb3683fb636663c60d8aee17ca9686a8ee3e57211099c993ab47ad375df
MD5 25f1ee495b98ef08854b24d6dc139046
SHA1 b97c43c0e6934826faf33e893dc2e5abd69a2d75
SHA512 31a5fe4305d4e041acf3d952a8dc4b2cdecb05130e5a6a29e3988c978cc80b1411c5f11bc48bc26753f96dea1822caf75289464005610af61db87dbe3add0910
TLSH
T153E0D8A055CAD6FB728B20EF4318EB0C81F2B40AD7CA2DE57B0D94407306140B2471B0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 1b420b12448a6f09f5ed1e7ff023ce216d2b84c6a8fa20618c2381fb31a7d532
MD5 e7277209f5b9372a01dbafcf35af2571
SHA1 97a25f9eb12914194bb38723e3d3fec1faca65d4
SHA512 38f518cdffbab997b78b9b3710c05a9a4896c1def37e2188a694b965741205c0a4962e08dd93d08acd3619a830f6f59c3e2447242ad744772ee0f41d3f51c18a
TLSH
T1AEE080F086C5D6FB708568C78778AB0D87F0BC4E97CD3D95BB0848417545145F2695B4
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 ab19457434c04424a7497da684a5b54dfc3ef4e3bfc4ae6ee79dc787ccda0c24
MD5 54ce8f70232818b5442dcf021a682fce
SHA1 6b9a83a039128fa43487f882c47e35c75e64a9e7
SHA512 0377daebe14d91a0a7eada22f094e491676482b4988438efc27a09efd6cac992319fd53aa96b0bd9809bf0cbaf68925b5110e466b9b16b048acbe703c42a24d4
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGd:05ppxnY753RNBvRJJdt7p5J9x9djFxP
TLSH
T1ACC2675A713B0212397E2988B79596364F4275A33058E4BF7FB810A14F67E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 398238115a84dcc5b5fb51553950ebbe6dfa3b2820834807f99d8c57ff0854f1
MD5 74c2824fa64b535ce73c482d18fde2ca
SHA1 7d764720b4bb2c87ab09b91b42ae80032e0705f9
SHA512 83868b3e9315fdebefa80418e44ef5d62a11b74c6ebca3ec6b438a66c3abbca4cfeac639b7470ab4be8c4e67457fc4b9312492d108671bef0ed225d6eccc2b50
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGS:05ppxnY753RNBvRJJdt7p5J9x9dY
TLSH
T13BB27B5A703E0212397E2988B79596364F4235A33058E4BF7FB814A14F67E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 06356802e309a5cddd3d4903865b95ca4e6c8cb699e17be2674a35677dd6523f
MD5 0cb3beac5550b4113127f65076c4b0e8
SHA1 0e1cd66e1df70d14a8e948da0be3e4a601124653
SHA512 362a8e7ce50e59280f25746da70a7d1342c9185ee6c3f678b67918f8dcfe88ae05317617d9212766090650d027ae6aafe9b2bf0cad6c529ec52d4d6dae55b073
SSDEEP 192:P+xWtbkVfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxu6fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T17F24630A7B747001EDE6D9725CB080771E3CB16DCF22A6D15DA264698DB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 a5c766fbceb7de60bec14538ba5ed0b78c3f3f8b39052986f990dbf78c4deb14
MD5 a63807aa50f7661dc1b7d518fb2d6ff6
SHA1 8095980a9ed45d16e81459a3e5e60f1df285b870
SHA512 018ee3374a31ba07b56a5ae0d206d18336ce96c57b6a9620195cbdd8192b82b9b2a228d3801aa0f1db255ae945396f265647b4a58d231fa09ef1a89ec1553922
TLSH
T19A5191C193A920C6BF89B9C1D20E5513ADB23E56220E9CB5732E94F59F44C250B7FD35
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 b0dd1180e2eb0e6a052bcb326ec5177f6440e0383db50e216e1b76f9fb68474d
MD5 debdf8c8e64d3dddeaa66362752f1cde
SHA1 419f83ca6976d81b1fd5e61fd463ef49b951cd49
SHA512 410cb162930037916994041ec34971be67b76eba6ee68a49721d8fe07d4ac6cecc31a282348e98b073f472f84f37feb191fb75a4d880a9f784b23fec5b6cc45e
SSDEEP 192:mQOA4AsBDl9HNCsMFP4flrbhQHIIImbWMIMQRYcY:GAhsBJGsc29QHIIImbWMIMyB
TLSH
T10E52732D6705BB3BC06E6F7713568A589BD9E8430277222D31621C4F9EF3A5386C52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 90b69eaffd01006062d0c7f0bd9fbffae433363e5d9622cb0b1c9de1630da03c
MD5 fe66ba323077ac46b6429fe946032d63
SHA1 6fcf93fd01dc07516c6dd250394a705916631fe9
SHA512 6f58d0459fe472bceac050b04ae12744feea9b9f143adb570760772bd260760164ff8c793025003c7681176873277f7ff0441fbc38e2f16de28a253079cf7747
TLSH
T119E020D5F4C5D1FF716870C701785B0982F0741FEB842D49BF01C488F40260076C9271
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 9e72a48b3bb2f1ba346703a2f29a6e0cd440630caa078ef9bbe2e36b2bfeb664
MD5 9902aecfb8c02490e757eae2dfc7bc94
SHA1 3431d0b700243264392ea8624dedecf95716c8fb
SHA512 8c5e0431b8f2b63b3cf35aebf7e479cbcc056328c9158472240e7a0ab071eaa332a7ea2e23c15633f96dc78955b28917cd948442d526ba0ebfb82aff117d51b7
TLSH
T1EA219D55F320C159E18E863AA46B9B261378E8129FBCEC0F847D24352D72E045E8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 7fc19f9f4fed0f610e8bd33824513540c649b6448f3fdeea2b834f939b6c46b0
MD5 aa8fd554fdef526f70596c8323c44c73
SHA1 190779a721d6ebd33cc2de0db3bb5d7330ad6a94
SHA512 806ac460fb4ae5905640813ce6b3717b762a7da9ccf1955bb463d27e5d7add8032dbd1371f15c0bed67024e2e7194a7865bf3163545d0c87a8724fd9c08b2d76
TLSH
T176E0D8A4B5C5D1FF709968C34179A74D83F13C8AEB882E857F05C8456545142B65E171
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 bf76ebfb85e10449c1c8565b4c9546bb53ac6099f93acd3ec96a1bf3ffd65e8f
MD5 e9415f2acffc7d657c1e7ce2790bbe7b
SHA1 e114bee3a383c529e4b79e8dfdbbc50d3bc04558
SHA512 7dca0c425c5f6f032cec348ad67387e105b033a877b79bc0517b8addc2f860d54a40c68e06787badbfda744eeed9a0d041288dd58c5ebae6b414f813c500608d
SSDEEP 3:MsEllllkEthXllkl2zEelXQet/:/M/xT02zNAK/
TLSH
T18D44040DFFC41405C514143041D1C3700370DC50051757433C5504F3DCC77400C03000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 1eb4a00c2341c771684ba66f2574272f29a94dc15a9f4dca47d1763c7eb345d1
MD5 d6f25a82ff9c1cd55eb4ea865aeb6607
SHA1 3b4e325dcfc7759dcc430166690d02a5e03e76a7
SHA512 0ec346329c33f23e50d62e3bd23ab539209883a4ee06f133b1b5bf488e246d17ccea2d1d2d4486e7d06bc1006ebb00c1920bd0c523deb2d850eda7d86bfeacaa
SSDEEP 768:YF7cpXhwgJkpsoGm3p9fT8g1AKRshVI8p03Ls:JXpv43H1AKyhVI8p03Ls
TLSH
T1ADE23A72D8948DE7A8E28EC9A70AF512ADE4013785D8999CD6F97D3D309F0FD0306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7ae95308833728bb8959e9df09268ac970d257afd51fa019dcafb4e4897e43f1
MD5 b5d6ceb6b31256b59679709d75e76d0b
SHA1 7685f71fd681dee87db0e36c1731e6f112b45c39
SHA512 1f8cdc91994a12eb0fa42310d91f52f75d8ae7098f52f5f4c2bdb4feb0a0e7a0f2b94bb851d83d23c142ebf8057e667f65092e1573f6ba4f5083a02be4479782
SSDEEP 384:npliF9CcmyWCs3sNu8TUNTUlIm2QckCr9lEKphiftGm3pfaKpCe4KV8p03LBty/I:psFccps3bwgbkUOkoGm3pfaNI8p03Lj
TLSH
T12FB25C36E868CABBFDE74F99B75E7A03DEE4116786D899D4DAD81E0C00970DD0307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0a99b222d279238307ab2b1fb426de70d4fe723710278e3eee3ccacf6019c23b
MD5 8577907fc58155008651f1a90c71bd84
SHA1 fe7931c896bc74c46a5d961ebcd307510deb909e
SHA512 4a13b9fbeea57d2347275f98ad55aab428f070a1e39a992e8744423eb2808386c37da850a9255a4db67ed95fc45a763d464d26b22c9244731dd75069f6463504
SSDEEP 384:npnriF9CcmyWC/3sN88TUNTUlI4IQckCrOniphiftGm3p9JLZaiHe4KV8p03LBta:pGFccp/3hwgJkJsoGm3p9faiHI8p03La
TLSH
T141C25B36E868CABBEDE74B99B74A3903DEE4416386CC9ED4D6DC5E0C00971DD430B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 2d8630a2c289da57be4c45680e8ee25c2acce8e75022b3d12c4e547514b60ecd
MD5 e8857acd8cec535f60c0a6a4955524a9
SHA1 83f3508e218f758d42b60ec868e1c5f156fd3608
SHA512 8732263b577c7336c1566f0b5e7c54265e822e6cfb4d22c516d5d8ddf6a2c2dd9837d09e1010544a1f7b41e2baf58707ee0f2a77117afb9fa7d34434acdca3dd
SSDEEP 768:eF7cpXHwgJk8soGm3p8J9WvCsG4o8p03L7:DXvQ432WKszo8p03L7
TLSH
T1D9D24A32D854CDFBECE69AC8A75A79039DE4117386DC9EDCD6E86E1C109B0EC070B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 7af5c23ce8ebc7e730dab7c181e17ee7dc5ead516f6293ec4e6083fd7c9ccd43
MD5 7ddfcfa49f7487d1fb6618100f43cf47
SHA1 0fd590290ad953bd7604c9a30112c65db68a543c
SHA512 af092fc4ae0132c8314ad75935e312ab854bab99ab1d14539d8758ce4fbbf66f79ba6e59b36129935f5f67a8db973cb0bf09ec8b3d0979f41f21865ff1f855c4
SSDEEP 768:YF7cpXhwgJk+soGm3p9fT8g1AKRshVI8p03Ls:JXpG43H1AKyhVI8p03Ls
TLSH
T178E24A72D8948DE7A8E68EC9A70AF512ADE4013785DC999CD6F97D3D305F0FD0306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 3fc4d2886e19fc7c62ce8f3b54321803557c1f51ba202b5bef2a27248b811b04
MD5 49c8a083b106e1eb759b9a7b7057c378
SHA1 865099ca4ca5c487aacc5f8d337e9f2e6bc31593
SHA512 76cbd3835521f70878b25d134f2d3468bc980be0b2026ed9061f5ed17f46278cc3bdce7a56a7f72c7cd86343ed011e9ac72f7397496525cbd16f9b0aba526001
SSDEEP 3:MsEllllkEthXllkl2zEeliK/:/M/xT02zNiK/
TLSH
T15E44040D7FC41517C71450304011C3F00370DC510517574334D104135CCF7405C01000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 87B
SHA256 c7209c3eb51763e3139fa0a5e5a1d18b610932294b507ba5d043658e45953727
MD5 8e0265073c65dc7491c8b6eda0b62e0d
SHA1 b75642618bae1886d9c426b5183a13da6c21acd3
SHA512 45b190ca41357baa1dbdeff2b123d27428be4c2dd69cb88cb6070f5d6abe9a7728f47fa2844592b192c17961580225348aeb1ec270e161a7422c1a8b71a239d8
TLSH
T168B02447C473C00FF41440D1C45C03C114F4C047411DD0015070D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 9061cef2dae36773bac05af99d1133ae3692f735df7565ff5f17f40a9deed9ec
MD5 88bf35a77b25e16c2037a71dfa6c2ddb
SHA1 2d6c7cfeea66e7cee4cc057e175d750b3f25d8c2
SHA512 9ae87b7b18aa23df20082c9f55ebc9d731675eeea7cdfe9270bda1f6c72d9c44280986bb3b6415da0ad26735e6949728b8e46327ba31cf424615aeded58b7e55
SSDEEP 768:OQaOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:xLhaqLI1WcxKgdfHJHH
TLSH
T1AD63D9FB495B02D0FB9941F4924B76CCC35B299C8CF8E7D2F96188176AB04B4E255A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 12KB
SHA256 8c414e02e796982de1c6563ad72bca6ab24acd22c31898d8775a609f0a8ff8d6
MD5 99db2b35fe3b35f45c56ff6bd84f55f5
SHA1 25c3059ab79282cb338c5e41bbbe1760fdef5fd1
SHA512 a692809371216213aa41ce521f3f9bbabc4ccaa2a0af4b50e5ceea12b5fd354bb6456f1739cdbd212b45cf00874cc98411f03d782590dfe9336f378dfcc4fe87
SSDEEP 24:C4RAC5fqqLo4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwD:1pqqp/IHRH34kWqB1kQnjhHmr6ITmUM
TLSH
T1E942896EDA2CA9A2FEE00B3ED7D1D0127B36A60EC2E4D5F1095B905747C540805DB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8e33c4697a16062840ace1b0a5f7ecc48f50c1c5955d2c0fe4b0966ec07a81a0
MD5 19f85daff11ee0913c37c3ddd0cd44ee
SHA1 caecccd8288de34fe31627c84dbd7ba8ca919307
SHA512 5243b28baa86d9d8b6eff5f2cdda41d8df974eb6b59f459f5680c68ceee991107713d573431f36b8d768cf865b7852165b7dfe7b7843bda1863fa986b98d2f8d
TLSH
T182412D58BAF91148B3B7AE5A9BF6686D447E78372F06D05D00010E4F0A63B00C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 833acd09058108fd712e01f4bc8ebb66fdd8a750e9211831a204831aa2b781b7
MD5 5f495ead7b53e706906483dfbbeee6b9
SHA1 a6025b0d8ecdbf123da40e2822136c4abc467d60
SHA512 a2709ae928f93e18bfe882ebbbe113424e98907e6637a2d397b4ddaf0a0daf5b259b006be7a50ab739ef467d65e0f702c9ae6d09668be29cd8ad843308c70baa
TLSH
T1DD51285CAAEA1149B3736F5A6FF6686E487FBD322F06905D10110E4F0A63A40CCA1B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/612-441-0x000002D029AE0000-0x000002D02AAE0000-memory.dmp

Download

memory/5276-160-0x000001CEC4EE0000-0x000001CEC5EE0000-memory.dmp

Download