hxxp://staarvegas[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://staarvegas.com
Sample260702-ss2flad13p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3708	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274794597655632"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{5509E481-7286-4E74-929C-43FDD7179AA6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 2024	2564	msedge.exe	85
PID 2564 wrote to memory of 3708	2564	msedge.exe	86
PID 2564 wrote to memory of 768	2564	msedge.exe	87
PID 2564 wrote to memory of 4456	2564	msedge.exe	88
PID 2564 wrote to memory of 768	2564	msedge.exe	87
PID 2564 wrote to memory of 768	2564	msedge.exe	87
PID 2564 wrote to memory of 4456	2564	msedge.exe	88
PID 2564 wrote to memory of 820	2564	msedge.exe	89
PID 2564 wrote to memory of 2508	2564	msedge.exe	90
PID 2564 wrote to memory of 820	2564	msedge.exe	89
PID 2564 wrote to memory of 820	2564	msedge.exe	89
PID 2564 wrote to memory of 2508	2564	msedge.exe	90
PID 2564 wrote to memory of 2508	2564	msedge.exe	90
PID 2564 wrote to memory of 1692	2564	msedge.exe	92
PID 2564 wrote to memory of 3188	2564	msedge.exe	93
PID 2564 wrote to memory of 1692	2564	msedge.exe	92
PID 2564 wrote to memory of 1692	2564	msedge.exe	92
PID 2564 wrote to memory of 3188	2564	msedge.exe	93
PID 2564 wrote to memory of 3188	2564	msedge.exe	93
PID 2564 wrote to memory of 312	2564	msedge.exe	96
PID 2564 wrote to memory of 312	2564	msedge.exe	96
PID 2564 wrote to memory of 312	2564	msedge.exe	96
PID 2564 wrote to memory of 3172	2564	msedge.exe	98
PID 2564 wrote to memory of 3380	2564	msedge.exe	99
PID 2564 wrote to memory of 3172	2564	msedge.exe	98
PID 2564 wrote to memory of 3380	2564	msedge.exe	99
PID 2564 wrote to memory of 3228	2564	msedge.exe	101
PID 2564 wrote to memory of 1544	2564	msedge.exe	111
PID 2564 wrote to memory of 3336	2564	msedge.exe	112
PID 2564 wrote to memory of 1772	2564	msedge.exe	113
PID 2564 wrote to memory of 4384	2564	msedge.exe	115
PID 2564 wrote to memory of 4384	2564	msedge.exe	115
PID 2564 wrote to memory of 2940	2564	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://staarvegas.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ffa34f9c188,0x7ffa34f9c194,0x7ffa34f9c1a0
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,13706222904369575736,10492898827505105070,524288 --field-trial-handle=2240,i,10834171071652619627,6030977745198730985,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,2053524139478625327,13017767926868591133,262144 --field-trial-handle=2240,i,10834171071652619627,6030977745198730985,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,5274549928451613555,12865641573448372245,524288 --field-trial-handle=2240,i,10834171071652619627,6030977745198730985,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,555932542238170453,9372625344499360060,2097152 --field-trial-handle=2240,i,10834171071652619627,6030977745198730985,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,7663455818799225645,15367887451504372255,2097152 --field-trial-handle=2240,i,10834171071652619627,6030977745198730985,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,11154608284092982183,16042035239341087882,2097152 --field-trial-handle=2240,i,10834171071652619627,6030977745198730985,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,9438845272917507458,11299829928726784596,2097152 --field-trial-handle=2240,i,10834171071652619627,6030977745198730985,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5064,i,1821973308717376634,6433296989103965208,2097152 --field-trial-handle=2240,i,10834171071652619627,6030977745198730985,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,1617373192992551384,10350193545349838582,524288 --field-trial-handle=2240,i,10834171071652619627,6030977745198730985,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,12387856599286442033,14719911984738482731,524288 --field-trial-handle=2240,i,10834171071652619627,6030977745198730985,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,3601673685858022847,929126790015156088,524288 --field-trial-handle=2240,i,10834171071652619627,6030977745198730985,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,3601673685858022847,929126790015156088,524288 --field-trial-handle=2240,i,10834171071652619627,6030977745198730985,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,14974534023407472510,1973299451945987607,524288 --field-trial-handle=2240,i,10834171071652619627,6030977745198730985,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,15806574416438652381,10766616108268341369,524288 --field-trial-handle=2240,i,10834171071652619627,6030977745198730985,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,7340034864238779971,18401229857484932318,524288 --field-trial-handle=2240,i,10834171071652619627,6030977745198730985,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,1215420420863688491,15440695975685985141,524288 --field-trial-handle=2240,i,10834171071652619627,6030977745198730985,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6040,i,12343251742377589459,4471752091035610882,262144 --field-trial-handle=2240,i,10834171071652619627,6030977745198730985,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2141057d57d63dcc320a6ca46583a4b9844bf2b41a3536331a0d1bf1558d3b0a
MD5 c807895a802ba3c563d91630ed5ccd5d
SHA1 e16f6d54b4e160fb77243a7a2b68bf725eed3fea
SHA512 1e391de5b5f8888a8d21066c4835700622a9ed5bdc0e661539b524bf3596bec842373a8f573dbeefd02f65912f2b2f8c96223dd80c2185f341482a7462134ef0
TLSH
T12E713B84CEB2C591F7633C32D2D37129753976B84D13AF260344EC3C6A2AB2E7EA5140
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58777d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58777d.TMP
Size 3KB
SHA256 4ba2b08c17ee38dd074bca9f7fab8ca09cf976aace23ebe41e3f828244103620
MD5 35f3329dc1b7033d6178c7d5a64d45f0
SHA1 3bc1e0f0f454930565a0b94863248f0a9f52ea6d
SHA512 0cd8b36d71efe367ff82901eeecab781258e5edae856ab77a0defd0b1f04cc8a9a1d0c68f5450c653e8082c76d2ab2f48635dea01457b9572ce10ea41eb40818
TLSH
T112714D94CEB2C591F3233C32D2D37169753976B94D13AF260344ED3C6A2AB2E7EA1144
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84af0314-4188-4e9e-847e-acdcd9279d05.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\84af0314-4188-4e9e-847e-acdcd9279d05.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1cd928f1694d8f25ce13ed27a23cc8706408c7b99bd76ff6c30a69ea028bf73d
MD5 1aa3de947153e3ee921aa76e6d312d36
SHA1 3a26fd56a613e685394c7ebc37a58fad7e6a5e74
SHA512 bea2d729e917a524f60e7e1e23e1ded3f57195fdc949c4497c9f2752f7620c51cdca0ba9315f7a5590b9826fc7df9fcc80870ab1216293cafe537b20d178031e
TLSH
T1AD11ADF3C3E185AEC90156F0AA24AE1BCE2D0505432C7C2585D4EF1B83E3075E10165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5697ee4a53e05e1f96a17b92d7e99718d4f9630173d1bbe6c7ba6eed915d1391
MD5 99a9d8ed900ab31a59dde7bce1897c01
SHA1 1f379b6132cb9962fd191310036041d8bf428d2d
SHA512 6724423084126fef517077c525c4c39b2bd3273cffdb6d8d32cf75f4b51d8251bcd1349643280484884b78cc67b6eb55ca4c4c49253d6345236e274f918cf31e
SSDEEP 192:sxZWRAyM/jK1Ml8UQQkS/fGsbS5/JIdpbaHW6+WN5YfgZYLfOaHIg5QJ:sxZWyqjS/fGsb8/COHb5FZUa
TLSH
T12552D7226A385977CCDBD209BA55BF53E6F5147292540E48AAFCCB0C01E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 35b017310bdcc865d38e1231275cc8cac3ee64627fe3a76e5850d06db8df59e9
MD5 a4f27f7803757cc5fd4bbc0226223461
SHA1 5397366882055108672fc92755848214ca41de4c
SHA512 6a2b325df9df2cf0762a3e4aafb39aa844915e938803227bc771375cecfd855107d719201f624f175b000ec56e44cc568d5106dbfa9471362027dfb2ca05ebed
SSDEEP 192:sxZWRAyM/jK1Ml8MkS/fGs0SS/JIdpRaHW6+WN5Y7v/YL+jSHIgrJ:sxZWyMS/fGs0H/CAHb5s/I9
TLSH
T12E52E8226A345977CCDBD309BA55BB53D6F90472D2900E48AAFCCA0C01E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 71dd9afffdfd95ce1d49f3424a18389166d37542da998c3c32cb72fdc6d28cd8
MD5 fccf54093399c6e581afc1f9457f6766
SHA1 71f9fadfb2f8a92c3b367e91f62678c590887ac4
SHA512 542426e8b6e7687dd82716851ac620333a80d1003d4df06d75d6a3741e88efa466eee2fe9bd320708332f169cb88b8cdceea9538f86b6e5c7bcd40d5e79ccbaf
SSDEEP 768:Y6s6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNhrobDc:Y6s6pD1WvxzWju1jahILIsNabDc
TLSH
T1C9D2FA3B680CCB7E4F840E5CEC2A6E967DD801CBAB98895447FA854C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 9832dbcd3ed621053666943bd33ba609545a0f309be8bf2904de41870bbc0cbe
MD5 34172ddff6fc571659f086ac3b4da44a
SHA1 d4adae2cbecdf6cc06aa345372fe7cac366de41e
SHA512 16f9fdc3036c9929b68cc6477268df576c939349fa8f0227a0683b3f1974c875bd71be9489951cedbf3b7fefbd838ed954a1b381c281c2410b4ddb04b1ba1c31
SSDEEP 96:KUAAKtePuV2Ku8SKy0K3KE3SKAUeqooK52HYp8Iv:iixdf+Zj2Yp8Iv
TLSH
T1B1E1181232BB03433C3E6948A2658B274B86B1633118F42B7BE905B11E67E355DFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f5ab4f1-0c61-408a-92c5-c0e2a335ad62.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8f5ab4f1-0c61-408a-92c5-c0e2a335ad62.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 20822db3a32e6ab71ab30fee2853c4ba32b7490a2a8f12ec7e699344851fb2f6
MD5 37cb2a6554698b96b91e66c2447bd46f
SHA1 d3751f6201b7b2bf99f7676f03f3eb7a12ee9116
SHA512 524dbb4c9a95940a30e56cd96c42e916210857ddd10723305d44246cc4a79c81cda7a4fe98efbba35eaa93ee7f6fc471844077e0325f12f4c763382a495ead13
SSDEEP 384:2tNn/s3n9SfsNIOau32a91AlWj2Kl8BhBTPLBliRwx:2j+9Uy37N2Kl8BvTPaRwx
TLSH
T11D927D316C681D770EB39689F54735074EB44077AAC52F94D6EC6F1C01DB2AC234AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ff2724d90caa191937938720e1c9ca6425f72e48a3fed089edbea4e23b0b4a25
MD5 0c43b4694ce648b19e7a74ecf0a8c165
SHA1 8da24353d5bc4ba37029a60215ca4e4d078d3cab
SHA512 0567418d1b44c42d55f8cf8d2a2d311c2c6c97331c28c991a7b3ddea2c3e8bad5124992532e6145e6a67b18399c10b0c68c56ffa861fc61946827ca5d31dae80
SSDEEP 384:EiF1tNn/s3n9SwzsN48TUNTUlIllauB2a91AlWK2Kl8BhBTPLBliRwx:fF1j+9P1wgl37U2Kl8BvTPaRwx
TLSH
T194C229F248DB4937D9AE8B47A77E2D034EBCC067B5842A50B7D85A0CCC961BFD306925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d4f5f97fbe3f25f31bd79ab9aa4b3c905704db692341a13626e2218197306b5a
MD5 26db704e7125ceed0be1220e96dd73e3
SHA1 fc41ee85b63b83b54503778ccd05c33639ca347d
SHA512 4ea6e23aedeaf4c8da07b774e0516549b6e1fda2d7dd5b0ad419d04eea7b41e35af27410eac1d597abb15e5fd1cd565a896d051c21ae83b94f6eec929497c678
SSDEEP 192:qONc6O7+3hQmiUy6OGttb0X+FA42YlgG/AU6:qONc61kGt91AlQIU6
TLSH
T14502D8356C786CB78AF2AE46B58727135FA5113BA9A52F84DAE81F0C00D765C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3a6e6113a691ae5bcaf4e1f2b0992507b7dd7aee29053983709e90a7fd016ad3
MD5 226e9984af6463204448fca560d7f438
SHA1 cea2449dbf5e0118c3c7e6775969b67e754c378e
SHA512 f96e609f6694615a242168d294e11f4a3abe900449449013333d7238f6187882ef4ac1dcd6de25117b41387498fcc27e9aade0f5042b11ddd2fa2a1f91bfc10c
SSDEEP 192:ZONB6O7+3yQmiUyPOittb0X+FA42YyuNhcNDqZ5dU6:ZONB607it91AlWm2U6
TLSH
T17712FA366C6C6C675EE3A545F48735138EA5413BDE8A3F80D6EC5F0C01EF6AC234A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 127a928f7dd4d075999f6b88d0ae757d1999a24129d1a50423da9dacb77f6120
MD5 ef86d7d021c84e4b7a5e1a1ac801c718
SHA1 dbcd48a89b52bdf17f0d4d8cde9576087eb0326f
SHA512 06b69eb9b0fddaf75c34bc712bc4d5e198b053294fe4e7aaf4dc8488d0c39ada44b9b381ef8998185e4649491553737bb40565d9338c9444416fc2a71bc8ff1e
SSDEEP 384:/tNn/s3n9SfsNIlau32a91AlWj2Kl8BhBTPLBliRwx:/j+9UZ37N2Kl8BvTPaRwx
TLSH
T10F927D316C681D770EB39689F54735178EB44077AAC52F94D6EC6F1C01DB2AC234AA2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1775f6db-07e5-4b9b-8287-9e3bb42d1215.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1775f6db-07e5-4b9b-8287-9e3bb42d1215.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 87326cb1d47af4583aa4c581f2f407c90fe88e85c1062aed4f826c9f051f2c8a
MD5 24049222b6867c763eb0c33275dd49e8
SHA1 82bcc0f7a61b54b967a97b376206ce52b21a89f9
SHA512 538ace4c1549967edf31bc4a6ca7f19e8dc1c401ff926b46902645b59c74d03d16227f1c24d12a7c6133b7f4ab2f8321ad5fcad319f0185134a1416c73df8bd2
TLSH
T1CA410948A6FA1148B3B36F56ABF6646D487B7C372E56D06D00010E4E4A63B40DC71B37
MD5 SHA1 SHA512 TLSH

Submit Download