hxxps://www[.]reddit[.]com/r/cloudygamer/comments/1coq5f3/stream_with_sunshine_moonlight_in_any_resolution/

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.reddit.com/r/cloudygamer/comments/1coq5f3/stream_with_sunshine_moonlight_in_any_resolution/
Sample260620-ct7e8sd12v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2876	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134263958042597588"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{CC2953ED-2A64-42E4-87FE-BEA7A20A8005}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
676	msedge.exe
676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 6120	2788	msedge.exe	87
PID 2788 wrote to memory of 2876	2788	msedge.exe	89
PID 2788 wrote to memory of 3524	2788	msedge.exe	90
PID 2788 wrote to memory of 3524	2788	msedge.exe	90
PID 2788 wrote to memory of 3524	2788	msedge.exe	90
PID 2788 wrote to memory of 4980	2788	msedge.exe	92
PID 2788 wrote to memory of 4980	2788	msedge.exe	92
PID 2788 wrote to memory of 3956	2788	msedge.exe	93
PID 2788 wrote to memory of 3956	2788	msedge.exe	93
PID 2788 wrote to memory of 3956	2788	msedge.exe	93
PID 2788 wrote to memory of 3240	2788	msedge.exe	94
PID 2788 wrote to memory of 3240	2788	msedge.exe	94
PID 2788 wrote to memory of 3240	2788	msedge.exe	94
PID 2788 wrote to memory of 5320	2788	msedge.exe	95
PID 2788 wrote to memory of 2872	2788	msedge.exe	96
PID 2788 wrote to memory of 5320	2788	msedge.exe	95
PID 2788 wrote to memory of 5320	2788	msedge.exe	95
PID 2788 wrote to memory of 2872	2788	msedge.exe	96
PID 2788 wrote to memory of 2872	2788	msedge.exe	96
PID 2788 wrote to memory of 940	2788	msedge.exe	98
PID 2788 wrote to memory of 940	2788	msedge.exe	98
PID 2788 wrote to memory of 940	2788	msedge.exe	98
PID 2788 wrote to memory of 1280	2788	msedge.exe	99
PID 2788 wrote to memory of 1280	2788	msedge.exe	99
PID 2788 wrote to memory of 5768	2788	msedge.exe	100
PID 2788 wrote to memory of 5768	2788	msedge.exe	100
PID 2788 wrote to memory of 5552	2788	msedge.exe	102
PID 2788 wrote to memory of 2040	2788	msedge.exe	111
PID 2788 wrote to memory of 3168	2788	msedge.exe	112
PID 2788 wrote to memory of 2260	2788	msedge.exe	113
PID 2788 wrote to memory of 4728	2788	msedge.exe	115
PID 2788 wrote to memory of 4728	2788	msedge.exe	115
PID 2788 wrote to memory of 676	2788	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.reddit.com/r/cloudygamer/comments/1coq5f3/stream_with_sunshine_moonlight_in_any_resolution/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffb32cec188,0x7ffb32cec194,0x7ffb32cec1a0
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,3700465358827861369,15676730327437841887,524288 --field-trial-handle=2272,i,13438087486305852919,17590342835061598577,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,5283294297626877281,7666531223659958330,262144 --field-trial-handle=2272,i,13438087486305852919,17590342835061598577,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,14728323528322233637,11087123783236612653,524288 --field-trial-handle=2272,i,13438087486305852919,17590342835061598577,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,3360890782863679410,17821791809968300652,2097152 --field-trial-handle=2272,i,13438087486305852919,17590342835061598577,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,14322724921188393245,8343432855590363903,2097152 --field-trial-handle=2272,i,13438087486305852919,17590342835061598577,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,10356541264771917648,15725155629201159944,2097152 --field-trial-handle=2272,i,13438087486305852919,17590342835061598577,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,15508093570003518248,2943582103486451978,2097152 --field-trial-handle=2272,i,13438087486305852919,17590342835061598577,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5092,i,4384650410911052960,958167855992554913,2097152 --field-trial-handle=2272,i,13438087486305852919,17590342835061598577,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,9630322992785011660,2806072461275621634,524288 --field-trial-handle=2272,i,13438087486305852919,17590342835061598577,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,11039600649351650552,10061676719911968445,524288 --field-trial-handle=2272,i,13438087486305852919,17590342835061598577,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,3952755756397469140,5427347687143388252,524288 --field-trial-handle=2272,i,13438087486305852919,17590342835061598577,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,3952755756397469140,5427347687143388252,524288 --field-trial-handle=2272,i,13438087486305852919,17590342835061598577,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,17550983842516721280,11945685262922196811,524288 --field-trial-handle=2272,i,13438087486305852919,17590342835061598577,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,7005606152830148062,83684479508883302,524288 --field-trial-handle=2272,i,13438087486305852919,17590342835061598577,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,8346666405975449823,12876912338682603719,524288 --field-trial-handle=2272,i,13438087486305852919,17590342835061598577,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,9132981982804640823,703519604582646903,524288 --field-trial-handle=2272,i,13438087486305852919,17590342835061598577,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5972,i,3518078911997913646,3932425850726661530,262144 --field-trial-handle=2272,i,13438087486305852919,17590342835061598577,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:676

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 375KB
SHA256 431a3251deb71c9c6d19db7ece22c26583f9d8fdba96fdfbb6a5b27d4214e31f
MD5 a3e719f84f525e2c6689b3f6ac73c402
SHA1 e3e93bf2c5aa88529ea3c1e524d2350245e91515
SHA512 0816380a9e625ce2e34fef598104a90a2724096b4d627bbe790c58008eeb3c50c732aa24500caa54fdc46c7f63216533adfb46d119a74aff4ed421b9f381ddbc
SSDEEP 6144:bk02i6NJqyLQCeqg5Vici0bU4rCHA9Q9lkOmEeWxF9Mh+kLNYr7tHLh:bMNJqybeqYvxCHAmXmEevbK3Bd
TLSH
T1A4842368F4BFE4A2AE8449215E5E0D746F487EB21740540AFB7DE2BB2415C493B6F203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 841f5a352f205117e20b2a81914425688de1951d06e8fdb707bf393f47b5b493
MD5 5b57867a08b4522b2e4bf1ddeec337e5
SHA1 a05b3d804d4c85c261e17ac32ae96f6aef0efea5
SHA512 aa73100c18b1b56ee0a94d17f634a2e6e7634230163c67fb40cbf3e2d1a422d9a0636aae27a5f27f19e13c2840d438c3ba4caa1c17ee92cea935544b3aa215bf
TLSH
T12F7108E6415D4CD0EFA10A30EED1AE0AF6B2AAF9D97B0FC5D605A57F1502B62D1073B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5860a9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5860a9.TMP
Size 3KB
SHA256 eda73ac11e5dc4dcbf85c4f97613e16d4267dbc604588ff00601406b44fcc381
MD5 f31a6c254e05e882155526201c33667d
SHA1 c9e3ec982e224f394e68b69460abb2167c51bea0
SHA512 4747b800bb9d6309ec04fcbc9f78cea8b969bab1ba7f35dfdab97cb281cd2e1c5f2024339d174534adcfa028006850df222b2fbc2ff966f33e5eaf3a00ef2407
TLSH
T18C616EF8414D0CC0EFA21230E8D19E0EF4F2AEBA89770FC5E55856BE2505B60C15B330
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 f70621e6ed68e9b72a0f1452a33702e16b96e20ecdceb068d2850d0447d227bc
MD5 e76b92468503c781d8d4732aae975df5
SHA1 73c85706e0d6887199405a51c11cc1a8c72f34bf
SHA512 3892c0e7f4d6e0b7d51fa8f1a9e291072c8b4a10a471845394111f6937d3ccec000cf7043247cd70d580ede964366de2950c52eb48b4e7369ea5496644b05c82
SSDEEP 192:DT2EqqrxD2BV+pNPrgrf2MjdPo6uqVhLfjU/lT5FLApxkDEHk:DT2EqsxiBV+pND+OMjdPo6uqVhLfjqlz
TLSH
T1DEE18DE3C7D8C62DC95116F06A24BD2ADE590A14432C3C69C9E6FF8B93E2531E311B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2497a7a237689f24be2033b41a56e27db30e798903a7b127f6e37c50df55690b
MD5 d1b041f48c6b4139f28258e16ca1b378
SHA1 c11ef35196bce0bfd3d4726764ed56f2aaf67e3a
SHA512 1f07d1cd3aa7aca0f5d5285179cb7ed83988bab0f8a0aa23928dbc434f2498eca9dfb0e16a6cafbeb386f89642dea12bda0c00a70aa1c98b6d5ad98f8e6ef89e
SSDEEP 192:sxZWyRvyM/jK1Ml8MkS/f9sxjYUIdpZOLiHW6+WN0ov/YH97Gi2IgrJ:sxZWypMS/f9sxjYN5HbP/l/9
TLSH
T11452C6136B78597BCCCBD619F955BF53D6F51462A2940E44AAFCCA0C04E6AED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e46b107ad68a9abb7b8681f40cb7c4554271ebbf5c1967c9c65e40b3a58c7bef
MD5 e2dcd774daa586d34fd2671cf75b018d
SHA1 84d320fce38ba0238e9aa28911d713663b7e6c27
SHA512 ba611e3b35fb6e19c2115aa11999502b970a26d11237ac6cf47d8ac5cf2c109f0ec8a557c6042071010f266ffd61d0e9295f3a62e4ae3c250bbe84ef2b01163c
SSDEEP 192:sxZWyRvyM/jK1Ml8UQuokS/f9sITYUIdpXOLiHW6+WN0lLXYHpiUi2Ig5iJ:sxZWypquLS/f9sITYNzHb6XS/Y
TLSH
T18152C6136A785977CCDBD619F955BF53D6F50472A2940E44AAFCCA0C04E6AED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 40e875dc25bf278e31dbe80ab81b005d706e26921ddb4b3206ba028aafe5e376
MD5 331d6946a6bc9fe77eb89b06622384d1
SHA1 66a391373c6fa1622a60c46a9a071914f45d3f98
SHA512 b28b454ef230916319d0a03e92378e93e72954c95e95e21fc9323e872189dbb7b87ae3204434bf2de60463e16e6f19268ee786ad58e098690492a8714eac269d
SSDEEP 768:jmUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RYroVk0Q:jmUZYTMWvg0Pou1ja7eLZmRjFQ
TLSH
T15CD20A2B280CCB7E4F844E5DEC2A6F963DD801CB9A984D5447EA884C03CB7EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 76cc3852fa783db3d85eef1d991363535a0b869c2bb698ff59f1b6cef095db1e
MD5 5d85d34b37d4a6bdf29339e79b819dd7
SHA1 8e9de9a7a6ecdecb8ba3ee565a5de2fad74df048
SHA512 69edf9163059c51440c6bbf43fcbf179941689f22b3ee6d5dc4cb024f6e4435957634f5e6f18515e97da130a9b0b53edd479f6d5a2ad25b439c94b802e9bbf14
TLSH
T1E7A0022101740182C54193F09B47019662644A514701671140E534D5C86176E452388B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5856a7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5856a7.TMP
Size 48B
SHA256 af2382aafb07bd712cc5654c32e585a8c36fd7aadaacc7bdbbaba9618bbfd7f8
MD5 a096759f71166b8aa3592fa17057b8b3
SHA1 b7d7fc1d7aae954109b57d23daba7d6f126d86b5
SHA512 ccc991b484677414eccb16c52863019dcf606267cfa1976ad5b0abd1adb6a818cae27115caf5833f1615aad13f5015c5d081d3f15456f441c4497a550322d51b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 c8484520f06814e962ff1ebfa9a4f1f59956ed5f2624b758b6d3e8541fdf722b
MD5 0b270b9e06c6377e254975a70e55a835
SHA1 8ba4204ddf43b088d40824cf0735946403dbef39
SHA512 d30c627bde1ca4d17dc49ca79cc9e87fdfb84b76cdac7fd60b7629deaef3323888804b344c83ce2d034a1a463274824e5ab87357d75c4e6b6eff4de9405d9c40
SSDEEP 96:KA1eK2AwZiKCsKHuz6OMEE+OUpl8u+KkL84+gmuRox+UKDKuaG8KLaL:E0VFFjnk
TLSH
T102D1171672B612113C3D6B0C82D597AB8E8272637019646B7BED00B1DE66E21DFFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9b1679bd6d32b6adcb4d78d38f4dd940df466e67a76fe807b24f3d8670d2f15b
MD5 d9d878dde0b5af1cfa5cac06e4ea5761
SHA1 64d55d6b4a2d5fd4e5e634f753cc9c3886f99c5e
SHA512 1122311d99bdbf44bb8744d2b5d9de64fc1af7d929dd2408fed7aaac9812cc3c87b780a1e0e6b8e63d09ee654cba3a788a391c7f67df0a0ee65c6e1ca879483d
SSDEEP 384:utNn/s3n9SfsNeXE9y8Kps8/zX5od+V8ykVVX9tJrO6+G/Pb9oRNR2x9/:uj+9Up8K1TOD1/hO6+G/ANR2v/
TLSH
T19A926C335538AC3A5ED3AA85F44736435EB45077B6853F8996EC6B1C00CBAEC130AE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 bd52ce95406c9037c135811a0e64b177486a43195615a8d7dccce1edd2866f85
MD5 9e7376c10ce7d312256d900494f8dae3
SHA1 52bb40db291b31299f329cac5d75e3df8aace277
SHA512 b35731f5fb3e72541487cefdcdbb25f8db888174c241cfa9cf41d7cf0cffd8eb78b42dde1a6445abc7a77f0cef65c147f04bf6fbf843643802eb496d9f0e0da9
SSDEEP 384:MF1tNn/s3n9Sv6zsNep8TUNTUlIlt9y8Kps//zX5od+V8ykVVX9tJrOg+G/Pb9o2:MF1j+95Twgo8KqTOD1/hOg+G/ANR2v/
TLSH
T1A0C229F345E7883AD99E5B47B73E2D024EBCC067B5816A84B3985A0CCC865BFD30AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2ecc182be89a1ccd2448b319f47cb2cfe113e9f0d9edc01285dd5c9a8690ba4b
MD5 f7452a9d044c45e338cc900467861bb2
SHA1 80cdfcbda6b41d2caf4ba0c4c0a3a222a3cb1b1c
SHA512 10e048b3f7a755913573809a42a277512880a3cd00495466f5d077bf844d7cb4016691170f92a5831977cf03a930b5a710a9a3bc104c7b8f1cd4ccd35f40b69f
SSDEEP 192:yONL61VWQmiUyN+gGX5Obd+j1jzorykaoX/a+R315U6:yONL6WFgGX5od+V8ykVC+L5U6
TLSH
T12902E935A8686CAB8EE2AE4AB48777135F95106BEA542F84D6FC1B1C009769C2306C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 21da86e6bf122394b142b03c8f45561790cce7bbac200563d6ea375422786c57
MD5 936fac1f277033b53861f216d7c857ba
SHA1 67256692dd62eff9fd44c3c38ba5625857002c8f
SHA512 263721ca05d8ca410ae7d12660164776dcf274c4628cb83fb898d8da826de32de0f4f3fa21518eaaeb08758044ce623ca608cf313c45510b18a9020bcc2b000e
SSDEEP 192:EONSW61+WQmiUy++dGX5Obd+j1jzorykaoVX9ySJrOUjJ+lqbU6:EONSW6TMdGX5od+V8ykVVX9tJrOM+GU6
TLSH
T1A6121A36A478AC6B5ED2B945F48731135FA55127EB497F80D2FC2B1C01DB6AC230AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4e9affea299a03cb436c94fd58044b51b728ccb7dfbdb46756d9972698846313
MD5 9425da9b90bfdbb8ab53af862d6d0d00
SHA1 8b282ebeb2f4a6cab865da340657d6e30139028e
SHA512 faf8ae8458e027b5135abb1543227cdfde99ce1d59a23489e87ff29cc9bc1710cb4b554681bc5fc6acf84a6bfae53e9b27a068a8a0a6efce26b237565264f883
SSDEEP 384:LtNn/s3n9SfsNeXt9y8Kps8/zX5od+V8ykVVX9tJrO6+G/Pb9oRNR2x9/:Lj+9U08K1TOD1/hO6+G/ANR2v/
TLSH
T151926C335538AC3B5ED3AA85F44736435EB45077B6853F9996EC6B1C00CBAEC130AE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1c9935659b872a481ae52658e4f5cce38355c0f8ffb58f0fbd9667f0c1f99b9c
MD5 8781175aa99ad841c88dad12f4779b38
SHA1 5b56a10ff263d566b90d7f21b97919d2b651dac7
SHA512 c71cc25cf25c3a3e52612fc9e405a32d5df593daae7b72831503a962173fe3d05581b7ea80fb8846e75282e768e11d9dafdfa808d5a53c874be402a9cc89bd92
TLSH
T12E41F45CB6ED1148B3B67F469BF6A8AE447BBC772E4A945E00110E4F0633A40C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5552-270-0x000002CB03680000-0x000002CB037C9000-memory.dmp

Download