hxxp://windbg | Triage™

Analysis

user interaction
yes
max time kernel
599s
max time network
572s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://windbg
Sample260730-pergpahb79

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
872	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298873057360102"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{BDC99171-3362-46C5-B63B-CF0717AA9BD4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2900	msedge.exe
2900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 860	1736	msedge.exe	84
PID 1736 wrote to memory of 872	1736	msedge.exe	85
PID 1736 wrote to memory of 4524	1736	msedge.exe	86
PID 1736 wrote to memory of 4524	1736	msedge.exe	86
PID 1736 wrote to memory of 4524	1736	msedge.exe	86
PID 1736 wrote to memory of 3512	1736	msedge.exe	87
PID 1736 wrote to memory of 3512	1736	msedge.exe	87
PID 1736 wrote to memory of 2964	1736	msedge.exe	88
PID 1736 wrote to memory of 3388	1736	msedge.exe	115
PID 1736 wrote to memory of 2964	1736	msedge.exe	88
PID 1736 wrote to memory of 2964	1736	msedge.exe	88
PID 1736 wrote to memory of 3388	1736	msedge.exe	115
PID 1736 wrote to memory of 3388	1736	msedge.exe	115
PID 1736 wrote to memory of 1076	1736	msedge.exe	121
PID 1736 wrote to memory of 1076	1736	msedge.exe	121
PID 1736 wrote to memory of 1076	1736	msedge.exe	121
PID 1736 wrote to memory of 3852	1736	msedge.exe	91
PID 1736 wrote to memory of 3852	1736	msedge.exe	91
PID 1736 wrote to memory of 3852	1736	msedge.exe	91
PID 1736 wrote to memory of 4348	1736	msedge.exe	97
PID 1736 wrote to memory of 4348	1736	msedge.exe	97
PID 1736 wrote to memory of 4348	1736	msedge.exe	97
PID 1736 wrote to memory of 3828	1736	msedge.exe	99
PID 1736 wrote to memory of 1288	1736	msedge.exe	100
PID 1736 wrote to memory of 3828	1736	msedge.exe	99
PID 1736 wrote to memory of 1288	1736	msedge.exe	100
PID 1736 wrote to memory of 700	1736	msedge.exe	116
PID 1736 wrote to memory of 3408	1736	msedge.exe	103
PID 1736 wrote to memory of 3408	1736	msedge.exe	103
PID 1736 wrote to memory of 3408	1736	msedge.exe	103
PID 1736 wrote to memory of 3952	1736	msedge.exe	104
PID 1736 wrote to memory of 3952	1736	msedge.exe	104
PID 1736 wrote to memory of 3952	1736	msedge.exe	104
PID 1736 wrote to memory of 3284	1736	msedge.exe	105
PID 1736 wrote to memory of 3284	1736	msedge.exe	105
PID 1736 wrote to memory of 2804	1736	msedge.exe	106
PID 1736 wrote to memory of 2804	1736	msedge.exe	106
PID 1736 wrote to memory of 2804	1736	msedge.exe	106
PID 1736 wrote to memory of 4228	1736	msedge.exe	107
PID 1736 wrote to memory of 4228	1736	msedge.exe	107
PID 1736 wrote to memory of 4228	1736	msedge.exe	107
PID 1736 wrote to memory of 3484	1736	msedge.exe	111
PID 1736 wrote to memory of 2196	1736	msedge.exe	112
PID 1736 wrote to memory of 452	1736	msedge.exe	113
PID 1736 wrote to memory of 1076	1736	msedge.exe	121
PID 1736 wrote to memory of 1076	1736	msedge.exe	121
PID 1736 wrote to memory of 1076	1736	msedge.exe	121
PID 1736 wrote to memory of 4948	1736	msedge.exe	122
PID 1736 wrote to memory of 4948	1736	msedge.exe	122
PID 1736 wrote to memory of 4948	1736	msedge.exe	122
PID 1736 wrote to memory of 1724	1736	msedge.exe	123
PID 1736 wrote to memory of 1724	1736	msedge.exe	123
PID 1736 wrote to memory of 1724	1736	msedge.exe	123
PID 1736 wrote to memory of 4380	1736	msedge.exe	124
PID 1736 wrote to memory of 4380	1736	msedge.exe	124
PID 1736 wrote to memory of 3732	1736	msedge.exe	126
PID 1736 wrote to memory of 3732	1736	msedge.exe	126
PID 1736 wrote to memory of 2900	1736	msedge.exe	127
PID 1736 wrote to memory of 3944	1736	msedge.exe	128
PID 1736 wrote to memory of 3944	1736	msedge.exe	128
PID 1736 wrote to memory of 1008	1736	msedge.exe	129
PID 1736 wrote to memory of 1008	1736	msedge.exe	129
PID 1736 wrote to memory of 216	1736	msedge.exe	130
PID 1736 wrote to memory of 216	1736	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://windbg
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffa9aebc188,0x7ffa9aebc194,0x7ffa9aebc1a0
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,18194175327841702521,1315575746328747465,524288 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - System Time Discovery
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,9870350088753541203,8674918336391400171,262144 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,14349884994470631150,16637669001357680169,524288 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,4526045825639234045,4961994216928921253,2097152 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,16539334921298281114,15235965765853848626,2097152 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,13553079464149645939,2375003494720639133,2097152 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,11398537094186986741,5410020129673047220,2097152 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:2
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3576,i,16655184158170754151,18037568427860486756,2097152 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,10885800241353849789,3163548401222198657,524288 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,10252188783477384144,5928135506496822483,524288 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,16914590469571350208,8019056116441007092,524288 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,16914590469571350208,8019056116441007092,524288 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6100,i,17642128948086726334,3512613426615135572,2097152 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5256,i,5168167052609746727,16396920791066307483,2097152 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,9659375028349919343,10509780455742784599,524288 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6832,i,14791308669514759032,13351211918372186886,2097152 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6524,i,14684248101735115956,18321368886092148828,2097152 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,16566007032432148106,5795493192565537471,524288 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,10972811544175732225,18285347467520453620,524288 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,15307125555400551542,10265686356645223067,524288 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:8
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4356,i,13598592114268509484,7687936052666850087,2097152 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5680,i,14515980275964099723,1089318843146143453,2097152 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=3624,i,3655043241461205089,6860661542678391705,2097152 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,18343926906435929256,6377032470427907034,524288 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,5851729420809650554,17394134082931380638,524288 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:8
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6040,i,9503249732592690132,16323578554746732557,262144 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1040,i,12317890209045533429,597434321147301394,524288 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,12090059843560726257,14382046960272359804,524288 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7260,i,9624903271159392192,9531582743715059849,524288 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:8
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,17621561440775796226,2750522842106868104,524288 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,14962222581233268653,14911641972126203054,524288 --field-trial-handle=2156,i,8844599498729433215,14834952326571221877,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3188

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:3388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 336c892aa519c9c1b08fdfc295eb642640287c7acf60b010f76182cb1d5dd710
MD5 746246453d6f7eba028138da2d38b83e
SHA1 d968de19478e0ea5724e7137b8c8a265452151e3
SHA512 9c34c1aaeb1f62af091d1a0931d52a2fa412caf8d3e5fd09156973636a9d9ef6cb1c6b00b39e6689685c928a4364fbcd96d38da51f7df0078c1555ed391df5f0
TLSH
T18CE0261B92B1E3E4D268958790A873D86030B986EBECC46E330AB49C2444D0053418D8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 22ead8ab868f692929de8d30a05d936a5bc0928d7e2f13a9c35232854e0de298
MD5 0a3ef7171294310f7a16f5422bfbb6b5
SHA1 3efd0680e35d9edb3a4fb477709aa632096315fb
SHA512 5a9e2df1a513cca724a9dea713847a9843ba16652a05914def7a83242905708a94156ca188b2c828d8ed02e91ff49df2beb2a9f7206448f2b8b52bc5e8888fab
TLSH
T1E1E0809885D5C36DD244658F826C534CD171378EA7D46D4E1704886C7143585E3935E8
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 67KB
SHA256 5e9ddd849c267cf191b2db00f575728d4b086f3b4fe31417a455bf0f4816514b
MD5 088ec17d4fa0e1202159915b03be22a7
SHA1 382daed964422de3fd5b9868d05253fd3ed4ffad
SHA512 c09cec454c2ed9330ae55066e690a1a017b3e401875a01df398872a7077ef7dd76b81cb9a5bd8d65e49b6170013f977a348e8b15467a9c96e1dda3dd949a030d
SSDEEP 1536:pAtMV9QuLlHIH7W6u5giUEJ/hnyydpMPoIShQg2WnFIZ3:pAmV9zZr6u5dJ/oydpMPonB2WSZ3
TLSH
T1666302B5D4F9178620352C8EA4F6907428EBA7F47950E9F050C4DF488DD8A7BAC08BBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 96KB
SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
MD5 76c1b9685c996f14f4cc8b585ddfb467
SHA1 e774b883f6b5736a9f0f0f05cfed247fdd8bdf6d
SHA512 d67c98951d327ea38ba3e761a229436782094e823847d989ddda919aa4de613bc7c5bb057968856414ecf2f2fe82e823bf3a04691d62ad7b67f7b6c142a807d1
SSDEEP 3072:rYsgcoaeqVBTILAbL7ABGMeTDm0ZSfKaXH:raU6qL7ABGMMmEFkH
TLSH
T1F7A3127B369F8CD14907CC51321A335688F4D0ADE2BA066B3D102E6A3B0B75F7A86F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 405KB
SHA256 1b60a6c04cc80fa726e3c5026255272c3b75303cc1666700305b3f9acf8b2226
MD5 e6b338d0fcf0d823a1874c7606dc62dc
SHA1 501f5d87f43ac13f1545286e3fde99eb15c5c5a7
SHA512 5cb49ce345babefaa0b4070245244a8cf2611000c2fd124532f43c764022177192f62a14090d3b5945544449788612326e215446cbe5f1830c4309720cedeec9
SSDEEP 12288:Ph3qrs26+46/k68I6l0X7+uHw8AVTQPUg2tQVy:PhqrL6+vkzI6yIVkY
TLSH
T16894237C930EA8852F3F559A617D2C8A1884F8F5CFD95E81BDE3E7E150A0D090B5B328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 12249c995ad28ba43499ec0f74e53a4ee4b37f757440318265290ec96e52da59
MD5 25a8985e4a6717631a8c0edccbdaa2e2
SHA1 dd5f7417e26e4e969c6467fcb85a2bd349973250
SHA512 60fc0e28caa967c8ee01307056946b83a4c5f78685b215fff5674c7f02a452bdb62c3ef0b7b912d5718c13bd1bd3778356b45a2520049b650335f7619d4ec90f
SSDEEP 96:Gmzrou7VTW7jQscf18+yWnjmANlxMtno3xz2doI6UMYmBLaN:VzR75W7jQjzVjmANT0noBKLfMYEg
TLSH
T11802E83FE0A2C0B0CFAB217150D484143075AAD5FC0FCE822DAD76BB196F7D1699A60E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 b6c8bd5b7f927f260bb01b23e848db287a4a05eae412e141285e2bbbd1e5b1da
MD5 36e01728ca521a21935383bbca002225
SHA1 1d39f506de472a84693614f45e18ce33150b5c32
SHA512 519318377f234870e3a2cea759d79cdfc9247f226775dcf69631d344fc25e57e3ba0043bb07734dfd57ba5409b8113e8d95f66d84156a2dd7cda089c086309a7
SSDEEP 96:E2zroa7VTW7jQscf18+yWnjmANcxMt/o3xz2doI6UMYmBLaM:jzd75W7jQjzVjmANm0/oBKLfMYEB
TLSH
T1BE02E87FE0A2C0B0CFAB217150D584143075AAD5FC0FCE822DAD76BB196F7D1699A60E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 314f15abbe5871f938af40d9c15f6285d0bcec221725be79d40dc1a5bb26f88b
MD5 7eb6b4e47cc863a5c3a4d48a3de727d4
SHA1 abaf49395e7569ed4136d33599009f2b808b7bd2
SHA512 d11df9f8b72202abce7ec48864fbe9fab96b154ffff6fec6f2b94f7ec9b1be52434bef339e81579ae42985006036a309a747c178d43ab62c3561cd45f43f5161
SSDEEP 96:DhOMzEh52zBcRdg4tfGO5tg14iE7vIPBbwBdQGAQ:DUMzEh521cDg4tf75tg14imvI5bkOGj
TLSH
T1F7A1DDF787E5826ECA1196F0AA18AF1BCF1C0552436C3C5985D4AF1B93F24B1E142B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 835e375b21260e5d809fa4710a820436c5e19e8e881ee1156a2c75093ef906ed
MD5 7dc4e891dd8af97f41f7aabc8bd90600
SHA1 907876ad086e17d61ffe567f77eca86dd3d86eae
SHA512 cec4280a6b0969bf2c0300c06e2b18ba25ed9e65986ad336d8bf7ea45b4e2500375b4206d0f96f5c73e5390e01727077f2b109a3e22e65fcbc973eb063a311be
SSDEEP 96:DhOMzEh5I/AzBcRdg4tfGO5tg14iE7vIPBbdBw3V4AQx:DUMzEh5Io1cDg4tf75tg14imvI5bbKVE
TLSH
T195B1CCF787E5826ECA1152F0AA186F1BCE1C0552836C3C5985D4AF1B93F24B1E142B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 baf5c6bedb56b7f0aaa80f1939b8f8fb8bef1a17f111d4ca5a04dc26c4bb323a
MD5 76ca949543352981e7ea6a528ac119f7
SHA1 27c66ebc2836bcd24ed97e8ecf7b9bf20996ab6a
SHA512 00e2aa9aadfdd34a0809b0d71a8e85ca413b075ab766ff7c96087d8a360fc5307feb5976e7c0a8266c041bfa6108f03a6ad719a1a99fc56e7359cb34e9852db0
SSDEEP 96:D/OKIMvXyfKzBcRB/GtfGO5tj4iEBvIPBbdBwBABGj4/3:DWKIMvXyi1cH/Gtf75tj4igvI5bbk0GQ
TLSH
T10F917BF743B5466EEA1195F0DD08AF1F9F1C005243AC796985D0AE17E3F24B2E052B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 30bae1a5f113782f8b31131b1670d73b635fd942f1422c5bc0c11d5ef2fe50f7
MD5 e6aaaaf4beef9e826786d21c9716ebf4
SHA1 31cde1251148987450d0d8f89b37643265527e16
SHA512 f6f4852866c0345ed66381af165df8236ed719912b058b1156a112637ebb6587ba3f122cce95c0b73138e27bf8e89911ed8c5cc7ea11c8419a638065a070aecc
TLSH
T129D02223360630B5A77CBFA941AAEC8FCB2610A00823DDD610D0E899053946C051714A
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58ceb5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58ceb5.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0eee45069884747d6491c93b6202f5306a34bb592fcbd2cb5da30ed6567cba1f
MD5 1bd44b439e181a98c37c347244e876a0
SHA1 0f70fb981a11000d696c071d33083a0ca601c2b0
SHA512 3bee8dcf5a4656ec5d68410676094af23a5b4677fb102d535f62f4f56f8ca02d879893cfe206e3bbea907c558dab821b02aba6aecba46aa7597a1618e2806af4
SSDEEP 192:sxZuRqyM/jK1Ml8MWOZ/fBs9CUVnMbxtdpm+UHW6+WNBbQ/Yvyct8LIgrJ:sxZuwuOZ/fBs9CbBkHb+/mg9
TLSH
T13652F706AA34597BCCCBD219F905BF53E6F91562D2944E48A9FCCA0C04E6BDD2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 1beb91e6b7f6ae4019af2e84daf7a1a1f6dcea5c44b31494b540d1afcc6b316a
MD5 159375f2c73241a2f9fd9f5ac4eae9f4
SHA1 37c6317e4cb71c2d6c4ab551724d8edceb3ad243
SHA512 fc4c28a5c1a052cbd5f4d0c746a50eb92e9b5952e7d02b8c0601553582b6dae0ff0cc2caa4f14d1ec746d917640e820c4bdcc7ce8e2f760505d77d255760ff12
SSDEEP 384:sxZgnbAq4m1Z/fBskPyNErBHbf7jtQZRg6veJTd:sybn4m1Z/fpPy+lHbf7qR4Jh
TLSH
T1E592E81766208977CCDBD119F922BF52E7F90462CE954E4C99FCCA0C04EA7ED221382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3d0fe6ecbb26613edfe5f6e95f25d6fb7dc795f9df325d0ee1c4eece18efb2bb
MD5 75629e983d868586c5cc5119ca5eb142
SHA1 2d7d2f7fa2e040814cd242c96190a32d3524945b
SHA512 b0788f12ec12d9d1bc2949c453717f841b31f6c8d9a5255492178fad3b6eb5556b80f7de16bfab2564287c366c44e0447ee824d7f1a173107827bf7c061cf4dc
SSDEEP 192:sxZeQUnURqyM/jK1Ml8MWOZ/fBskCUVn/HbxEfdpmPUHW6+WNBbQ/Yvyct8LIg5Y:sxZgnUAuOZ/fBskCONEbDHb+/mgS
TLSH
T16162E816AA24597BCCDBC219F902BB53E6F91562D6944E44E9FCCA0C04E6BDD2313C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 e21c3e0c692c766baed8b6613899eebeeec2cbd627b09f7657cceaf264850261
MD5 3aa845db98637b4fdf9e9a39e6ce9b20
SHA1 278fd509a02f4f45063070dd2095a41fdca7c215
SHA512 dfc4500a3375820625180f8f3bbf8561b52a8350cc257bbfdde82d7e64a67f56522882018eba5f1407d60ea30f9f9461f092b47cb08ac71b648cea3161219138
SSDEEP 384:sxZgnbAsm1Z/fBskPVNEr6Hbf7/1/ibg6veJTd:sybhm1Z/fpPV+OHbf7xib4Jh
TLSH
T1E682D81766208977CCDBD159B9227F52D7F90463CE954E4C9AFCCA0C04EA7ED221382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 bf9a98fdc88cc84a22380b6c71f765702df7887ab9e4eb0e3dfbe7a836227a4d
MD5 4f13ec722aff849ffe9913c03b9e3fd8
SHA1 3f1150513e23bfd7fb23f87771ba7c41e04ca176
SHA512 6ba3832390a66b15cd8f20d6a0742a6dd5b22e56cc6d6360168c5a16e920067e7ffabf3fd5a439651dbaea360c07be996dced30d97a1bce3f2d67f003b05ddec
SSDEEP 768:TjseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppFro2Fs:TjseJ3xWvhfynu1jaVcL88p+r
TLSH
T1F2D20B2B280CCB7E4F844E5DEC2A6F966EE801CB57984D5487EA884C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index
Size 72B
SHA256 590e491528d7a4b047d0d5dcf8ab54b86dde4fc9e3a0e731e9879dff2b03650c
MD5 8807ee7ab29100a0e4c992f9c45d1df5
SHA1 34570f8f0b7a982e441fa30fe1314018828c3631
SHA512 aaa87101f8d7ba7a1d9e5997a57e9820a9d2634ad0dbcadbb963633828ccb531c764bf0ff397cba2686691b32e185c4d80e61cd1a567b8e19428308c6d1b9c92
TLSH
T175A0021973D01431C40712F8359F01412314CE10421E23058EA1584ACC58A49555507D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index
Size 72B
SHA256 2fb00e7ccc5245d8cd18de5bdc1b6145351bd65495b2b113079a88fd068ddec0
MD5 37313b7f9961e8f3f83576d93396ae91
SHA1 45c67d46dbb07ea620eb3da867dad21a84387695
SHA512 5fc71c756bd8fff3a64611680336240da1e2d33e89eefd3df874a6cfecdfbe1575cae29d6e946ab3b9a861a623c11c50bd535a988509eec16e65b258bb40dfae
TLSH
T1EBA0021083C0C245C43A26B19DE302453310C89435012317809E0048CC546844DC504E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 1KB
SHA256 8dd4f9a48b82067f12d408e296aa40ef998ba0c57a06aefc7fd0f481e984d0f9
MD5 6b3267d0b0ac7248bedccc747652d533
SHA1 9dac91c9eda961beb26b72dcbe5440f0f7d06e8f
SHA512 9ad06d4c6a35909ed6e962ab5bc1ae42b10b110d46662c3156c8ef05b7e9d2a699fc970d69dc9178ed2720058dbf951fc13bbc586c76ab9f2a063beb44d0b5d2
TLSH
T19A2154494E92955FE5A84477147360E033B0CDDC171163635C7C26391C227D93D071C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 2KB
SHA256 29d8f606c2bf5ad5165ab263c520f95422ec4bcf7306929a8400303ce12d5df0
MD5 4df413328136929010a33e7f298ad302
SHA1 1f20b6340c6f82b5da111e9dfc0750bd7af3f2c5
SHA512 44596d68da1f89c0aac2bf0aa0c0ff1fda2d61b29f520fdc649ea6bce24026a02f161c4b7367ce8e3ac9705843dd50707fe790f1bc5fd8896404afdce8e548e9
TLSH
T1FD51FA4E4D4A7F66CDAD10F328F704C6333124FE46848B0BA55CE9703CC32252D2E918
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584169.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe584169.TMP
Size 1KB
SHA256 ba7b0757975713750a931f82c13d41cfaeb1f5a4321851f696e62ceb738ed646
MD5 5c649d31358bf30f0b61e924d20a7309
SHA1 9a65a6826d2ed0c4fd43932dcf46e1251853c8a0
SHA512 62f496145075f71cf57661f610d03067f6fe034d7fc70c26a9fe73e7d0c2a4267f04ad6a54e619f1c2a4d0704f267f0009a927c35590bec7951d7b83f3a66448
TLSH
T1642140C68692590FEDD440760143A4F43370CD00A322B383A93A223E5C347DD194B1C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 1e6b396acb6f3f2c780a9541923a4894cb268d3ac28e95b4d6092233f98d5fec
MD5 a1c088a12e55d96d67f7d47fefd3aa1f
SHA1 c2502c00e4b40bdd81d30c82ed3c1912ffae8a5c
SHA512 3735073bf7872cb067b65ea3ace976fa67c6ab0d6fda6ccf667e0711e3d10bc69df327238beab10af7f602d2f29a247c2af98a973aaae2cb9b4c2c40ea611d1d
TLSH
T139E068B62DD72414BEABC3D12430C090064A7498E941FC0E541AF6831072315309AC25
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 f40ce85b5be62ebae039315fb5a3cb45a213cd5a6617a82999234b7a34a42d1a
MD5 6b74f088ab8763ecbfbe82613aa2e12f
SHA1 284394f27c30ef3f579567a5eab28f30e6665839
SHA512 27dbcb6333fdefe16806a359e33a30e7ef44a0fad915602ee0d3c6a8c6deba72e3cd6d3aa56e8adb062ec36a0caa4fb3f75613161153eff585f8f4a07ed4b943
TLSH
T11BA00222C964C042C40102719A6101C4EAD18CBC9755232252AC04669D682C065D7108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589a57.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589a57.TMP
Size 48B
SHA256 84a5a0e007a62dd9486295e92dcd6e48f124dae2ffce627f7796d37eadc2f84d
MD5 3912bf8fa0a691539e9363601d2d33a4
SHA1 00df87e1a2d13c3b0c1f342025bbae207ddb1a49
SHA512 7dde70758d8117c7fce77dca4cfe54b8eb92fe931f4b4be0e33d845d7d5008d3e16723112b494eaaaac68d11417300de02ca9fc89601deb96f37591d316f174a
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 39155a534adc8e8d40b6d4f617e6aa8c9802da0c7fc6aaa0e4731f1b76dfe80b
MD5 769b44c29ebb49d4ab01af3fde78c868
SHA1 66f31c5deabadf8badddf9ab798c7867d1130b28
SHA512 689c7c4b197d8ac2a55b2643cfb2787aefc9f9cb947dda09eb89cec4a3d5d0bedbc770273f6f55a475665b15a7783d489a2c75f884e4f393cfb2f0a03894233e
SSDEEP 48:KYHIhKggkXypQIzKpisnypvKLfhVpk5V0PI0nkKDBrJkX/0aUhLz:KYH+KggmKQIKpieqcAKN2yz
TLSH
T12C916813353B074278BD2458B6A695379E4137933414B9AF7FB840A24E27E622EFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

51a464e8-2962-43ae-adf4-c12466ce36c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\51a464e8-2962-43ae-adf4-c12466ce36c1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 22d2501eaca0d4e976f4f4b3b0e7c576378da03d884324ca99cc69555ba3106f
MD5 8cdb95ede413b874f91aa4a5d1a2c4f7
SHA1 3812b80c34314aef69fbf049e24f8ea29ea4cb56
SHA512 ab1310ebbd5cad34c43ff2879087d499a8d506a33cb8ab22ed8eb55daf41aceeb190e4e6d578d943f812d13de127b2c4c29a4c404ef9ca9532f8bbd2e39b77bc
SSDEEP 384:YqiFiZcIuzsNU8TUNTUlIlLTeY7xC/S2NdtdUzLCY:YhFQu5wgAYASwBUzLCY
TLSH
T129B2F8F248D7883AD9AE9747B77D2E024EBCC067F5849950B3D85A0CCC961BFD306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c258221049df6ff84e4bc16274dc65a4c3acc6f090b8e94463a9f215006322b8
MD5 3f7995e6a2eb47852a2cf2cee30c6ed9
SHA1 280d05c54675b05c124f682d3a096ea786980913
SHA512 daaa134cb550e5b438f89956acadcbde97bdb4f918a5871a284b8d5ee2cbdcdf0c416b365adff0c864ceff02fc6cca454e92fb1f66f702b838c38f2a0a64149b
SSDEEP 192:lONF6vMtPQmiUy+4WThTA++FdLR847z4U/u:lONF6UtRTT+dVsU/u
TLSH
T1D602F935AC786C7BAAA7AE49F48A37175FE4216BD5D05B50EAE82F1C00D764C1303C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 4fa929e603ba2a1f2d61051eb0aa5647bb2df93c6631c2a5e00e67c5178364ab
MD5 bf87a5c89c16e8ee63cca2ab46bda346
SHA1 072ab7201adbc7f30f2959e07eff9c194ca72829
SHA512 caa49a502e7262de9a4375ec59fae571a66d3773b6938945b0a03f7c2d6c70cb1d6d75aace22d3eeaedddfc60ec8b9cfd4cd0343d42b76c3cdf5f92f30ac4a13
SSDEEP 192:u+dLsNcNpT2PX7M7dP4QmiU1o4sS8BMTA++FdLCgFd3E88z1WqvUMZ:rBsNcNpTeY7xYuS2NdtdU9LUMZ
TLSH
T1F5421936AC749C376AA3A685F44A36435FF0416BDAC86F94E6ED6F0C01DA39C2307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 63e7916ac845b95feed3c229bb995d6448ed2c44ce77885c09f36ba916d69a3b
MD5 ba9ac54c48eb496619d38ecef51e5875
SHA1 47c67cb67ee9d88f4549a69111206a61e8a9ff24
SHA512 7bff1b0e4d22fac2215e0aea47ee4a46704e3bb9ebdc54c7f8099e702ce8d000135cd61809110a6d132ccf1613f4a100036a17f74c3262c2034db0d6ba587c0d
SSDEEP 192:u+dLsNcNIT2PX7M7dP4QmiU1n4sS8BMTA++FdLCgFd3E88z1WqvUMZ:rBsNcNITeY7xYLS2NdtdU9LUMZ
TLSH
T1A2422936AC749C375AA3A685F44A36035FF0406BDAC86F94E6ED6F0C01DA39C2306D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 b13a2ac8f48a24bc8e999c3f2cc50607b8cb2cd2f9611309ee38901dedfc1f9f
MD5 da74ced7826d64af9448bf06ed4f9a4d
SHA1 21416c4ff6918b88408ca28355f1f5e2d027b2c7
SHA512 c263da2dee7cd2292e1f9c2c9e2b5d722960f1bbf2510c44223fb214a219531505b8ef663b9e15a6e8261d94f41a230458914c6b175269d0edef0ce59a533b44
SSDEEP 192:uxdm+xasuheOwQxMGsNcLT2PX7M7dP4YmiU194sS8BMTA++FdLCgFd3E88z1Wqvr:Q+ZcIhsNcLTeY7xCxS2NdtdU9LCY
TLSH
T169726C729C749C37A9A7A285F48636035FF48027D7C8AF90E5EDAF0D01D66A81307D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 067811a1d719f0bec5cb09526da1c1e34aa81bbaaa066b74cee831ed6f2355ed
MD5 65c444f7f6dc4c622dab44b886cda797
SHA1 e2e692adb6fdd3e626a9d629726b2e63b234a39b
SHA512 ffba86febf78e8a84e16a211b48555f3ed62a09b3c22e1b9de2b6e0da4390ef6cd42d436930fa627c13cc12944f832cb1839b072acc5f7525e2125bbe92be20d
SSDEEP 192:zONl6vMlPQmiUyR4WrhTA++FdLCgFd3Ew80IWqvU/u:zONl6UlR+r+dtdU1LU/u
TLSH
T110121B36AC689C2BAE93B585F48A32535FB0916BDAC4AF90E6DC3F1C01DA75C1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 53d74e69d371d28821b3f9f2bd2c12948095f9bc5c1290359cde161e4d6f749e
MD5 336c25eeab3ff70f0e422f36318d8cd0
SHA1 e697fa2e8aef87afdf3abb80e8286b92fd6a33f6
SHA512 9be14d9721edd727dff906cf1c60e4c9d67e30ec3d44812849a391f28b82727b4cec70f4716b4ed3f3d47e88257031ad5838ba4cbe67b252695fc586cdb63d21
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe59118a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59118a.TMP
Size 392B
SHA256 4f4238ab380f246608b20c0fb32dca51f1e3ee09de70764ad2c02646397d836b
MD5 a1dcffc5040a990a73a76669ead8ac9d
SHA1 49822f74a10c501b127513b41f0b44c9d3c6d4d9
SHA512 b48df5b9984a00bdb52dca92e39ee183d02b00879026359446d95fe3787050f991216944b6e676ff2f4341f8cb06ad438b8f2e8332c1e9580b5ff4796069cc86
MD5 SHA1 SHA512

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 484B
SHA256 9fd2b7fae87c2d863b486a425834283f19b1444749c84650d5a48c9eadb12e2b
MD5 e9289cc1f579fdfa9d46acfae9b38330
SHA1 7eac8e241d8c35d873280d6b9dbc1cca7a9b2231
SHA512 b1f37da50e387c8408a960ef5276a51336510286c1db7eaea4cde65af4efc343f8ac1d9de65df1fd0818513823a485733e5c155da615344bc044f46021ecf586
TLSH
T134F0543C33D821A4F08C46B23596ED8B88BF313247DC2631CA50F550315387701B5095
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 97ebff53d1d839e7a913bf71c8e9ca7c446f58b88b3bd3af7a50b854c69760ba
MD5 3ead604bf75fb6ef31c3a693c6079155
SHA1 1823f0f984c780afd62ed2223575f7fa87138357
SHA512 6f6b1cf92ccfac63e9cff6d03a2e7fd3c26a9fc338769d7457688f0fd59e5c1c513d0b726cefd0bcba2216ed123c77fe22ff6f043409cc3938b92c6f502b1510
TLSH
T166513C75799247BA8D652E7A9B00CBA57D98CDA41AB70080C36219A5858B1A71C033FE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 da23025dbe40bc829a22cd33d6c2b1e3c02a790a5f2a8a189dca11a4a4868b64
MD5 bdde99b27437b7745f1ad7bca114977c
SHA1 d7cc0f7e5cf297829b230f9861e1012ac3cf5081
SHA512 d03a96b90170f9273d24c4191f9cfd917b60874eda9880ee517ece9328b7c5da060c5c71483b5d7299fc1a1e59c386a26ff600e735d3c31c9e4b7f137d2efcee
TLSH
T136415B69A6F91008B3B76F5A9FF6686E447F79772F06945D10110D4E0A23A01C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download