hxxp://sap-kof-preview[.]hubx[.]cl

Analysis

user interaction
yes
max time kernel
339s
max time network
338s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://sap-kof-preview.hubx.cl
Sample260809-2s2wsscg86

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4744	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307895051998755"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{4961BED8-0167-47E7-BBC2-F59F0D73BA8E}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{74CC6A9B-09CA-4B8A-A34B-A0C28F077C2B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3376	msedge.exe
3376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 2252	1232	msedge.exe	85
PID 1232 wrote to memory of 4744	1232	msedge.exe	86
PID 1232 wrote to memory of 4856	1232	msedge.exe	87
PID 1232 wrote to memory of 4856	1232	msedge.exe	87
PID 1232 wrote to memory of 4856	1232	msedge.exe	87
PID 1232 wrote to memory of 1080	1232	msedge.exe	88
PID 1232 wrote to memory of 1080	1232	msedge.exe	88
PID 1232 wrote to memory of 1640	1232	msedge.exe	90
PID 1232 wrote to memory of 1640	1232	msedge.exe	90
PID 1232 wrote to memory of 1640	1232	msedge.exe	90
PID 1232 wrote to memory of 3340	1232	msedge.exe	91
PID 1232 wrote to memory of 3340	1232	msedge.exe	91
PID 1232 wrote to memory of 3340	1232	msedge.exe	91
PID 1232 wrote to memory of 4864	1232	msedge.exe	93
PID 1232 wrote to memory of 4864	1232	msedge.exe	93
PID 1232 wrote to memory of 4864	1232	msedge.exe	93
PID 1232 wrote to memory of 2008	1232	msedge.exe	92
PID 1232 wrote to memory of 2008	1232	msedge.exe	92
PID 1232 wrote to memory of 2008	1232	msedge.exe	92
PID 1232 wrote to memory of 3376	1232	msedge.exe	96
PID 1232 wrote to memory of 3376	1232	msedge.exe	96
PID 1232 wrote to memory of 3376	1232	msedge.exe	96
PID 1232 wrote to memory of 764	1232	msedge.exe	100
PID 1232 wrote to memory of 4940	1232	msedge.exe	101
PID 1232 wrote to memory of 764	1232	msedge.exe	100
PID 1232 wrote to memory of 4940	1232	msedge.exe	101
PID 1232 wrote to memory of 2432	1232	msedge.exe	103
PID 1232 wrote to memory of 2004	1232	msedge.exe	109
PID 1232 wrote to memory of 3856	1232	msedge.exe	110
PID 1232 wrote to memory of 2348	1232	msedge.exe	111
PID 1232 wrote to memory of 4860	1232	msedge.exe	123
PID 1232 wrote to memory of 4860	1232	msedge.exe	123
PID 1232 wrote to memory of 2220	1232	msedge.exe	124
PID 1232 wrote to memory of 2220	1232	msedge.exe	124
PID 1232 wrote to memory of 4824	1232	msedge.exe	125
PID 1232 wrote to memory of 4824	1232	msedge.exe	125
PID 1232 wrote to memory of 4824	1232	msedge.exe	125
PID 1232 wrote to memory of 1612	1232	msedge.exe	126
PID 1232 wrote to memory of 1612	1232	msedge.exe	126
PID 1232 wrote to memory of 1612	1232	msedge.exe	126
PID 1232 wrote to memory of 3028	1232	msedge.exe	127
PID 1232 wrote to memory of 3028	1232	msedge.exe	127
PID 1232 wrote to memory of 3028	1232	msedge.exe	127
PID 1232 wrote to memory of 2580	1232	msedge.exe	128
PID 1232 wrote to memory of 2580	1232	msedge.exe	128
PID 1232 wrote to memory of 2064	1232	msedge.exe	129
PID 1232 wrote to memory of 2064	1232	msedge.exe	129
PID 1232 wrote to memory of 2064	1232	msedge.exe	129
PID 1232 wrote to memory of 4288	1232	msedge.exe	130
PID 1232 wrote to memory of 4288	1232	msedge.exe	130
PID 1232 wrote to memory of 4288	1232	msedge.exe	130
PID 1232 wrote to memory of 3376	1232	msedge.exe	133
PID 1232 wrote to memory of 4988	1232	msedge.exe	134
PID 1232 wrote to memory of 4988	1232	msedge.exe	134
PID 1232 wrote to memory of 4988	1232	msedge.exe	134
PID 1232 wrote to memory of 2740	1232	msedge.exe	135
PID 1232 wrote to memory of 2740	1232	msedge.exe	135
PID 1232 wrote to memory of 2740	1232	msedge.exe	135
PID 1232 wrote to memory of 2672	1232	msedge.exe	136
PID 1232 wrote to memory of 5040	1232	msedge.exe	137
PID 1232 wrote to memory of 5040	1232	msedge.exe	137
PID 1232 wrote to memory of 1660	1232	msedge.exe	145
PID 1232 wrote to memory of 1660	1232	msedge.exe	145
PID 1232 wrote to memory of 3808	1232	msedge.exe	146

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://sap-kof-preview.hubx.cl
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff92ed0c188,0x7ff92ed0c194,0x7ff92ed0c1a0
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,8890372475967317930,15383183388733534431,524288 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,12947065178351487953,17112637257226491768,262144 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:2
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,2882576109374644940,9199088126020379185,524288 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,17700210391292162764,14396566395088074121,2097152 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,4361895787178183261,18340345821650256703,2097152 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,14549405371707056256,4204242565766468110,2097152 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,3915797915323378653,1481602374886594079,2097152 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:2
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3876,i,15135064821016018634,5424033799579688720,2097152 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,15382529550185496786,2302577583764962266,524288 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:8
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,4604792347771984703,2078217433300213569,524288 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,5433063118065527932,11679781766011324508,524288 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,5433063118065527932,11679781766011324508,524288 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,13731777653874138279,4443369755111169325,524288 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,5578764348046328205,9029616757269080571,524288 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,12842650718223253795,4287085733511028777,524288 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,12963854432051370325,12842732527445794336,524288 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,17913441722336007237,17381826432419820942,524288 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4200,i,6037350845201557114,4828097571920828857,2097152 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3488,i,7610584035855762198,5660603442117996567,2097152 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5072,i,10097242572715788371,2395261964019522654,2097152 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,10737525880215014692,11741646441058545543,524288 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7036,i,1027522669404457137,5974361413140685559,2097152 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4288,i,5861437297139132591,16768766979877212676,2097152 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7064,i,403906178378570683,13884552835977191011,262144 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=3948,i,10357627660724991695,4355867880565952339,2097152 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5236,i,12829508055108401325,517761774208376649,2097152 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,10840926106601123141,7494297772687357149,524288 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,16568634060739932746,16139083224926938353,524288 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7308,i,16707733810436100135,9391065330801134615,524288 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=1224 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7476,i,17791650094089763648,1852982857140184719,524288 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7632,i,14711572145843156862,12087657486798958556,524288 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=7620 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,14234800441782139683,17333928418510906554,524288 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=8032 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,5357546295782529989,7609808687700472214,524288 --field-trial-handle=2408,i,16905150848101518253,799342422397369250,262144 --variations-seed-version --mojo-platform-channel-handle=7888 /prefetch:8
  2⤵
  PID:5092

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 26374662fab280ef96eaa929fd16d9c29e3f74bff1e5cdf49f3940b212c74426
MD5 b3d937ce21fb8a9c36b91767a220b12b
SHA1 792049998f48955661735784aa1a6653cfd6d461
SHA512 05958eec7798844717209ca31b3321bd05988e5248f66df4ba666cf3bbad7c9d2a9fd23d375157547fdb301a268f9f7b0a6a6c7b7c9fa62856f0848ecb862773
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7l:fwUQC5VwBIiElEd2K57P7l
TLSH
T190B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 c406b6b7a1bab48df8181e94defbdbd45f772588bff3f9c0c9f98bfb9ec362fc
MD5 1201c449e7fa1a5d2fa6802d55ea5850
SHA1 9b2f994730da79cc398b0efc916f337e5953c44e
SHA512 b46efb8c679fef206df93bfd52aacc4255e1bd29d89de3419edfb0b7c589e16ca68bb1838ad521fe84447e1eb7c4c8a2fcd50808ebe92e210007998893e875b3
TLSH
T106E0D8BC52F4C7F82D0094C7B8645624C194710F9DBCD45A7304A48C2E62988B3EC8F0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 c8d6ac74838553a9713a9e9d4a066f8f538ad969c907f76a5bb7c3df1b5fec3f
MD5 f9f5fddb8d2a62f47b69df71ab686f81
SHA1 ba3180ae2034d04da3efa875186bb2a13144fdb4
SHA512 0dfc854dabdd16f5944d8ad99d6844a0693328f4d6f75c3c1372255c4a8cf2b32459f05bf493ee7ab1e30f6042af2c56b003b21f6066fc4049e499d17572bf0f
SSDEEP 96:b5WXBjtHoG58qbr5yqqlyBgVDa6znos+lUCl24e/Tk6APRqif:dWJFd8qbr5yUBgdSUa24e/TJAPRH
TLSH
T156020FBD51A58E50EF700B716AF65EEAB67088EAF47FCF1E26101C3B48323C39464552
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 5ba6d1357aea6cb81ee5d217532c47dfdc689af2083fd6a188f104990b1abed4
MD5 5e2187c498f1b598e5932e6227fd56a7
SHA1 77ee2657f9df8dad2edaf9a48835666f53624932
SHA512 bfa8c0be6818c7a69fb6c1f2c8c78a5f008b38f892ae8a5b23e0608da40e01cb811d910836871897acc55c091e9066727efb766d13e1af80c4733f2422fa9dee
SSDEEP 96:+Xgl9tmHo/58hbrRjyqLPDNyBgVDLnN6znos+lUJSMvnirj0TkFAXGRqiS:+wlae8hbrBySDwBgnkSUgMvsj0TSAWRK
TLSH
T125123FFD11968D50EFB80B7169E65EE976709CE6F47BCF1E25101D3B4833383986015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 0d6f3119216fbf70a976542d9f17cedbc2542e8af0ac57eb53d996f5f977c595
MD5 da79c1709f702f770180e82507c97772
SHA1 96f65be7f93fd353c06f8a214ca0178cce03e394
SHA512 b9ea6b131f7956a14a09ace367e55dbc3d6f837d813ef379de586fbf81ac0b8c0796268e3d0c87be0e009d7cbdf810a03a17b0730ec514834cba9eb54dee302e
SSDEEP 192:4+wlaS8hs7rBySDwBgnkSU6Mvsj0TSAWrX:1wlAhyqRSUaI07
TLSH
T1D7122EBD11A68D50EFB80BB1B9E65EE976708CE6F47BCF0E25101D3B4833383986015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c5f3d1dd3c82b73de73fb30615fca301c133e50146a485bfb24fdbe985d4283d
MD5 9e1339d24106bbee90428384b9daf744
SHA1 29a7c147fec6e34015971afbaa0aad8be3ccf0a2
SHA512 cd7df87fbf73b4a6a50a28b9423ab172aaab0e981d7722cee07fba31fce3eddc7b3048c1cf59bffd634ea9228e56d2213df16cca5e247c8434e391ad4d0fa641
TLSH
T13F8119B6225242A4FB9001B1A9FB9AD2F071E9FEF5BF0F5E8150987E4D30393451972A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b4b5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b4b5.TMP
Size 3KB
SHA256 7978fb9ba7faececc800f623c9c86158650c240c589eb88dcbdf535b6b5d5de6
MD5 1b68437ff4c12a0759d7270ef2a06bee
SHA1 68a45bffb895121ff702b69803a65665a0e570af
SHA512 a203a3e6d1c65d80210940ac927715f8e1ed207c266762d77ee016146622788325dfda1b5abd68091f5de0a08f28bbb8248df0f29da64841b897b0c491140e55
TLSH
T1708119B6225242A4FB9001B1E9FB9AD2F071E8FEF5BF0F5E8150487E4D30393451972A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9a2465c4a1b98e78395b96bff6b79ab53712f62a234f862acdb229ef2cbfbe5c
MD5 3f30c06010fe887b5aaf8886cabc1407
SHA1 fea4c798a99277c7f25ecaaaae9ed9e44c682865
SHA512 1a9109e96e7a485b6780ffa0b56b9537b7bdb788b6c75511c1dad5d8f816414008b768a3991a05cefe13021c77cf28c31edf6c78d67291487f71cc21c93fb973
TLSH
T166318BF383E486ADCA1256F0AA14AF1BDE1C0515432C3D15C5E4EF1BD7F2474E001A9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 a3367d22fb17460b068ca973f869e52369e120e62bf5df26e184d6a271afd27d
MD5 d2da5d42b91bc0ee1ef324a75adeed7f
SHA1 a8e297660952dbb2336c5d9cb043d58f2fe71b8e
SHA512 dd5d64a3c83da741753370a245c271755b6d7872278577702cd029cb03a4250877f05e493451bb02d8aaa60f4db928f8cdd1a4a67102369830ea77d90cd98a3c
SSDEEP 192:Dbac1/0T5SaRyi0JkiW1k3m57cHY0m/bxisvubziAJFQQANG5yrJ:Dbac1/0TUaRyi0JkiW1k3m57cHY0m/b1
TLSH
T1F6128AF7C3E9862DC91256F09B14AF1BCE1D0915432C3C1AC9D8AE5BA3F2471E161B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 480cbeab367c4c36a41d7e8400dddfa569136226e3f0a0fea30fecca9223a337
MD5 18c64933b5b2926fbe17ccbfc09ff6ed
SHA1 01223f95db4af60a703be72d20510d410307145d
SHA512 b00ab4707e434a3a7790f13668c49e012e7a64e26d8d4d5796b096ccbdb36eff815289bd4a0e968ff9e2992d007719d8a7134a41f245b404845d06ea975ed8e7
SSDEEP 96:DbDOc1/0nWzBwBmuBm55GOcRBH40m/MuxiEtvHUWI9:Dbac1/0nW1k3m57cHY0m/bxisvHUWI9
TLSH
T1BCB1CFF7C3E9822DD91192F0AA18AF1BCE1C0956436C3D1AC5D4AF1BA3F2471E151B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 0419beb65665503aa7f0a54af01c988a3b16bb418e659f9c42168a9b79fe519c
MD5 bdc8308e04c608eb9efe73b38d7dd875
SHA1 432a1243de5c1db35436a83ecaca5cb8bb98f693
SHA512 72a0bcf71214cb994dbf09a33dbed88fd7e1f2825ff4966115ff3310ae672162adaef21a0eeed5cc572e797d7445f71b0d2a86114a8b34874f84129754fa1b2d
TLSH
T1D7D022F31245B0B6A96E3FC5406AEC8FC33610700802EDE412E09C9E09BA4AC960B145
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5a2210.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5a2210.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 46a130c1d96369290af3026ad974b920670318fd74a3b73abab8e7d7ebe3207d
MD5 faf702ab585a99659955ce4bee4626cb
SHA1 5c624e1525635ec35e6c617d673aa5fa3d92eef7
SHA512 c15cc2446e372a6e11c6d8dbebdd4953192d462339ae18553daa80015ee929b4df0ed87d4407e02d2c89c30094dbb6bc1ac09a7c9d689fc02bd9bb8db9f65472
SSDEEP 384:sxZ0naTqHm4z/flsn/h2OCGHb9vIpsd6Tl/rtXfv:smauHm4z/fE/YwHbN6x/rVfv
TLSH
T12892E89265248977CDDBD119FD32BF53D6F404629E904E58AAFCC91C04EB6FD221381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2b35a1cf44bf7ee1aab49e170ea78c32f2f70b5a1251781d85be988d12fa8be4
MD5 7b1173d797b99f5ee3a1b4e81fe48f9b
SHA1 2e0195e22fd43012b6cf2a3ee2badf385ffefdaa
SHA512 029b8f9431f20ad34bf5dd9d12bcab684eba8eb6f5f38786c2163d20e6e8b4269cbc999c665f5a7bae2a1e43eb06825f3083b715f4d061e627fbfc7040d76d75
SSDEEP 192:sxZwRCyM/jK1Ml8M9z/flsn/hn2xV9IdpTYHW6+WNfd8IFYvlojYCIg56J:sxZwU1z/flsn/h2C0HbyIFzTc
TLSH
T1EB52D612AA345A77CCDBD20DFA41BB53D6F5046292900E54AAFCDA1C04E7BED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 1998bda12fc13f1f7a51c00a4d17720f9009f37c19bdc8eacf7fe3dc151748a7
MD5 485c352bb92659e0ad740e9d6321301e
SHA1 8be5edd3a10e592da319fd976855843f8ac9ec48
SHA512 13365368360328185c461c8f152f505aea7e39683430e4c422a740bd48d5900ff4cf54f196fb191568e05b2180eac30b48d2a168139e5590cd8cc2da0313addf
SSDEEP 384:sxZ0njUsm4z/flsn/h2OCpHbOIpV/tTl/rtXfv:smjtm4z/fE/YHHbftx/rVfv
TLSH
T1CB92D79266248977CCDBD119FD327F53D6F804629A904E58AAFCC91C04EB6FD271381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 17a8ac096f265cc1d17b8afd66784e96f30472553c2a4ef53efd1cfc7ada7d2b
MD5 b2ca21055072c2ce5e1553d7f0966849
SHA1 7916fd0bf8ddd6381f649784db41c87f97417022
SHA512 e45ded862a9d1795588f8b55ea18aa46ddc3d08fdf02e077a02de51e8bcb897b10daa93d27d936f8c26a67c0cd4f7ee941a04b9cf97cbacdf961147d79c4336c
SSDEEP 384:sxZ0njTqHm4z/flsn/h2OCGHbMRIpsdETl/rtXfv:smjuHm4z/fE/YwHbsEx/rVfv
TLSH
T1A392D89265208977CDEBD119FD327F63D6F404629E904E58AAFCC91C04EB6FD261381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1a864532e9a226a26f1dc8085458cc63b4661b57b71ee8d914bfcf3597549bdc
MD5 eaa407d116807ac3bd54ef18851db991
SHA1 896a468540f6c5680c7a97f0d28e7357a6864260
SHA512 b461841a3cf2cb131e3b60a610119a0b0a867f9086274aca0b7c39c80b2112379574ed028deef70320a124ba9822d6839f35a5c9d86a192d56ea867989157281
SSDEEP 192:sxZwRCyM/jK1Ml8Mkz/flsP/hndIV9Idp9IHW6+WNfwe/Yv15jYCIgrJ:sxZwUMz/flsP/hdt+HbD/CT9
TLSH
T1DF42E812AA349A77CCDBD209F955BF53D6F90462A2900E54A9FCDA1C04F6AEC231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 e7e584f4169826b650baebc0530c98afe385ea108a61ceca0360fa0914940e2c
MD5 9f223755453ee1794cdd9e407472a912
SHA1 46862ec84197ed47e6366eed01feb109fe8ed035
SHA512 6bca66bd6834eaa1857da2fc4490f1ddfb400f86c7d3b739869da9797f3783f87fcb62b6dc729141d44b75fc0eafb000f97b929d14d389e01ad15eda6e07f254
SSDEEP 384:sxZ0njUqHm4z/flsn/h2OCpHbOIpIZnTl/rtXfv:smjDHm4z/fE/YHHb2nx/rVfv
TLSH
T1C492D69265248977CCEBD119FD32BF63D6F404629A904E58AAFCC91C04EB6FD271381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ef7b530c65148c2d03654b82b478e24c6d030f0051270ea29bfc2e40cf3cb1c3
MD5 bceccdf261beb85e0c8456f62bc74f50
SHA1 22f848d9b4cf7db30bccf557c2faba3e0065b592
SHA512 d783442f937d10e4112ae814a56c01bab0bc4a1a087454bce8715fdaf514c3b781f042ee4bb9228d316f26caac1c9a26e8093ce90cbb82b0e8ed7dd7852f23d4
SSDEEP 768:S8seJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppJroR/fR:S8seJ3xWvhfynu1jaVcL88pi5R
TLSH
T1F0D20B2B280CCB7E4F844E6CEC266F966EE801CB57984D5487EA884C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index
Size 72B
SHA256 23c2f6f75113ee107d2298b2da22ecaa7fdf415da52cc91114fccd5fe85f2c4e
MD5 c582589163a64d89280db3eb452622fd
SHA1 12ba48e6df1ae46bb8ab8d0aab81f5d7525f183a
SHA512 2b36379a8eff44d36e4f3800745158d70b7254ba574ac5fa08ff16b3110c965314fdcdaee4fa0556b2bedd8cc7f8bdbb1542a749c4f5a1fabd4abf13e0e5e2a0
TLSH
T104A0021802D0206FC04327B029DE227563618910E605530945D04256C850566564B01C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index
Size 72B
SHA256 c68b74e38b952612c356b557a73449c33cf20879379f1f4b58817f74231b4005
MD5 cea26f02ba27ad53f5cab8483fcbe4c9
SHA1 640fd490aaac4904a831e932d46c43ee4fc1f41c
SHA512 dcbc0e1a5f42af22a46833b2f4b2724bc0297f98b4696f1590fea0109e8c97bf91a354ac6246de6f0f2b91d9c84ce4024e1beb13efc5a4314b2e7fcc8bd00328
TLSH
T156A00434DFC00105C45331F11F5347455300CCDD3110530FC0D14054DD705444F4310C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 1KB
SHA256 5518967230ead6c21e70521e8cc3d847dafa120d1e699680f363cc588caf6bf0
MD5 116059f856d97c2675239067495ad677
SHA1 9d04e5b86262c9276cef9594c96c12b613a760ba
SHA512 597d372646636a36f3a39eb9c9e1748de7580b8b7d872dee1b851f265ab91012f565e6ffaed96313693dae222d6eaa38d228a1bec61c19915216445695c53d69
TLSH
T1FE31638C8E91599BE85944B611B2B4E433B0D8DC072162635C3C36352D273492A4B1DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 3KB
SHA256 b3b5e84a46e8e0975bf4ef481d471fcf641b623bdb9338984983fab9b3c33f32
MD5 7c98d31ce843d8130270f797dc63680f
SHA1 017f7ea069e2f7aa0624b25219b76e21d2c456f9
SHA512 bfbe61cd1aadc6302e75982a54d3b49fcc1403bb1d81837d5505ef1091e0cd437c0c16c55773ad56b7b40bb5b9f6d008bdf7dfc153b34178a2c1309b44ca7319
TLSH
T12051C58D8C835B12DDBC26B218B61455377564EDA7895B03F99CB8383CC32291CB8B10
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59be35.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe59be35.TMP
Size 1KB
SHA256 b74a49e86c31798669095652b41de642fec880412af888563afc69b4d162c669
MD5 db5eb15c0697f91cd2919eaca5db8df8
SHA1 8a0f4966bb1f3a832d33c8f33270bf5d62d090b1
SHA512 e2059c10751df4c057714ebb34c621cb07d425fc0e6b876d75eb399e6fc94e955dc70f3f194304f7f91290dafb350be26e1c64367c36e97d3bd80f3b1204c7b1
TLSH
T13E31358D4A915A0BF89041B70A93B4F87330C8009322B7D3A97C66395D3178E5F4F1C9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 030a4867c2054cb02edb0192692182b1323516d727bbeea6c6fec558a876cfb2
MD5 cc0edd7cdd98ea62065f059e8978a694
SHA1 c0d7ba8d7de02c0e4298e951b90a149f2a067e18
SHA512 604a3f7c00e32313190939e131ac9544f5a8b0adc51ee042dabc6752806a563de7b75f3ae90589ce2c8a04ac3b7ac1ca97532b840d8f3ec32522eb9e1a30a7bc
TLSH
T12EE0C0B62DD32854BEAFC3D26030C090060A78ACE901FC0E545BF6C3107231530DBC35
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 b5b72cbcde7ea3319f9c87181efc640595ef495881bb87535e0c8fe92053a01a
MD5 22d3e525f80ebe7fcf17000e2f913ed0
SHA1 f487b731404b7b9d7a8d81720add00d5663ec188
SHA512 8bf39fafd60539af3bb416d595ce40f0864b515cbc447e201021bcc067e306fcf52ab8a8ec38eb4e3dbe1795d1c66575e68c44a61699b7be991e2f0d9dc02f16
TLSH
T15FA0025E8F5DB045C0040770D0A5418C6A509CDC074D72114CAE005988521C441E2129
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1639.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a1639.TMP
Size 48B
SHA256 0349b174bf032fdd4d77dc89e9d9683691c18860d51a59869ec0f133e450e39e
MD5 f66b7f8faa1abe0a64ee4efd713712f1
SHA1 cee4e59edbba6f158b6ef17041ef948c9e240ad8
SHA512 37116e3ccb1153a88fcb0efc30e1f84cd277900ba326055b21bdff5898d73a12b2c024495e21b40c1981035cbd402d93fa1c8409698bfab68f9d1f663d3ec257
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 44279f6ad4bd59b24d36a22a4b835a7cc036a72bc23a9d6b1956bdeefa2c40cd
MD5 eb5c9c5e4abccada7db39cf0d8ffe03e
SHA1 b032f3d25d67409e0a286073a96d411b3bf8c1a9
SHA512 b84c2157dde33af2a51c5b48ca14012ab89afe15c4735f1b83775d267614e05adc1f5ff1cfe89e1b804b4564c985d75777876a3acc60d89ddc148e82074ff191
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1E3:KYHIhKggkXyBOIHKnq0jy9TINK4UIF
TLSH
T1E9912042343F130329BD284CA7A59E368E4171A37464A5BF7BB844A21E27E161EFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f9369f99-1a84-457d-9b85-9f19d9798732.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f9369f99-1a84-457d-9b85-9f19d9798732.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 d7b9fafaea2a7438773ea430ebe5ecf41d2dfae0b1a61cfbfce832a98166c6e8
MD5 4812c419247f61406cea54ceee0305b1
SHA1 4f768f881b1a4f70dc104a950517406629229649
SHA512 e845eeacd27d5da4b0079d4703eb483d7784414e8c06bc9d9e0830bbe62eaf3ed0d146842fdd4c2642ebb3f1819be474245c1d0eac9f389b33490678ca6f2954
SSDEEP 192:udm+xasuheOwQxMGsNDo0QPSUor1VmnM791kQmiU1+5+MV4MTKcCOxkk8z1McqBr:zZcIhsNU0sTorN7r0uKxOxSMHRt
TLSH
T1FA624CB2AC749C7A99B7B141F48A37035EF48067A6C45F50E6EC6F1D00EB2A8031B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 7752bae8f7816f4627ea4cbb0c723638206c0e24379ae64158bf70e2ac24fbb7
MD5 e6baa24001f3abc1c624e02bc4a4859f
SHA1 0a3265f70c2b38ec7b1e73055875a114676ef011
SHA512 63bac34bf4f40cf77e86afbaacecf64ac4a92a4516543b7b217ca7573a54c445eeaa6baf9d6ea60c61d0bd0cac70214eb6913025ae88a2167218fe1079725b82
SSDEEP 384:biFiZcIXzsNc8TUNTUlIl0sTorN7r0TKxOxkMHRt:2FQDxwgErNuARMHRt
TLSH
T1DFB20AF258D7883AD9AE9743B77D2E034EBCC067B5849A50B3D85A1CCC961BFC306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 2600882714ebf49bd7d62fef521947fa0dc66850114f9b7b9c53fdc9f665a9ae
MD5 2c30ea99dcce0779c893d1863cd5baab
SHA1 d9199afee47100ae8e2aea69aa38567f779df835
SHA512 30a91bf35221a33587b97a8fee938d73e05def749f73930a9058d9bf5e87180a8dd51af421085b2bbf961ceeb8fef4ece532b23f25afcd483870743d4b4d0e77
SSDEEP 192:uYLsNDofhQPSUor1VmnM791kQmiU1+5+MV4MTKcCOxkk8z1McqB/0:hsNUJsTorN7r0uKxOxSMH/0
TLSH
T1CD4208B6BC789C7B9DA7A541F48A32035FB4816B96C46F54E6DC2F2C01DB29C130B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 075db16f76d82a61f4c3c25b7267b4d9064e47d3dfe65f720761168517ab5548
MD5 bd7fb79bec2b3b77d3d3dfa309bc3680
SHA1 1127425c9a14f344f796878e4b44d5c7d23e363b
SHA512 4fbc849ac735bdd141c03062f84f10e07c96d87b979ff1fc8ef5b3343234c52c18e2df67888934d1b0e5bbfb2a7007bcbd1381954e9c4f7e3315f2ea45a6f8f4
SSDEEP 192:lONx6vMtPQmiUy+K+PThTKcCOxV847U7U/u:lONx6UtRLTSOx1OU/u
TLSH
T1C202F935FC786C7BDAA3AD46F48A231B1FB061BBA5905B50EAE82F1C00D725C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 4b3fe74179c6d13e896d221f8a82a227e457c07e866946627ebe01b20872d3d5
MD5 ba7ccadc0b9744eaf60635a6b4438f66
SHA1 36eb1eebccdba4e0f657bb3d9e5e566d7037d365
SHA512 b85176ea7fd0f81dd44e3bf6e6c8ad1b26c53d53a03cf5bcbc97c1cb4dbeb77351a3566b01e71f661ce2432a9faa7d31e23a93d6508234bfb01e4a81e03ce9d6
SSDEEP 192:aONPV6vMHPQmiUy+E+PWhTKcCOxkF80IMcqBU/u:aON96UHRlWSOxBMHU/u
TLSH
T15112FA76BC64AC6B9DA3B541F48A32171EB4816BEA849B50EADC3F2C01EF65C1307917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7caacec544f665fea7cfe897f977e8a63b404f75293e1dbc49c885399266b5aa
MD5 d77c422de9bd2405c27abdf7a3ffc494
SHA1 c33d964cebead8fc5ec73dfe2ecb3e00ef6f62b2
SHA512 c7f495de7d3100ec89ee82fd4785a4a05f8e69ba90e4e722af7012e87e3e2aa5d2d72dada9d8745df9fa02345b2ff30865b1da3feadfac5708a6cb89cfb25c23
TLSH
T1B1E009A7970000BAD428033000835F202FE3C26002F286064E21496D2CA77407E68A84
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ef73f530237abd7675a29defd45d7ba8894c2d3b49ea32a3d4e9276ee8ebccab
MD5 5edb1ddc2535c8e091a447dbcd48665d
SHA1 6a3a612383319febf06c3fcf7500ff89baaec071
SHA512 1015910b7356e48f57c8fa3493d56ab707d3477729d0b69876271b6127248abd74317051613a8bbff6c5f9b4025bdd74bc999213cf3471b197dbd738291c1e8e
TLSH
T137E00257D300007FE43C033000435A3026D2C11001F186054911455928975406B74FC4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c29d637160e0b0c1263270fbdc0428fb51992786755966ed7cc6038f6ae2bc0f
MD5 874f610c604a42b4115755aad724132b
SHA1 50069e71bc51d570d7905909c0df0a538888bc68
SHA512 46581efdd387167fbd4daa7dbab63ce936c45aa62072a412ed7c203e3f65de086a75269aed1cd4f177aa9c38818b0858d7e61c01b8eb84e99aa7e8ce6ac310d3
TLSH
T17EE00417D300003FD43C033000435F3037D1C10001F1C3054511055D3CD57401714DC4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 06f00641fc73d652f66ffaacf52ca545ac938c848c5c262eac8c51fcce3a713d
MD5 2f14f9cae88b86b07b84c0af8bd26ce8
SHA1 c775647bfc81798cb7058e4af330ffdca5b6ffbf
SHA512 ceb0aa31e097bf1036bc0f7d96af65857d9ec612dc81ea664ee0b72cce5ad16043fd550ebbf649cb61885d96cd7a84f9b89e3886fc5495e3917e5c4a914c3fad
TLSH
T126E00157930000BFE42C033000835B202AE3C12002F286064E2145692CA76406E74F84
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 71166f137e13b1babcf4492e04c07d959496e6449c1ba92a683cff3c273e7b6f
MD5 ed69d87f360a7b60fd3c83f39efb4c77
SHA1 ddf7701c0adc414a098f059de2825adbbed59219
SHA512 e51f54c90f579af21f29f5f60af96596af57c34ac3f7776a086a32388f1c9c4a989f1a98d39a827a3847fc51609139d49311c4755de7884cb34771ece528b356
TLSH
T1A4E0096B970000BAD428033040831F302FE7C2A402F686464E2105A92CA67887E79E85
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59cd68.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59cd68.TMP
Size 392B
SHA256 4e2b5cfa98ed8eb96a47323cc86c2424affe0985a16345bc209644545305635a
MD5 d8dbdcce364fee317c7682461023ba01
SHA1 efdc33f657cb8e0b3514cc604be1c8eada4118e5
SHA512 a405db6e98355f0c18509082eb3545f73fcbc2e3029386da33557a1b7ac8d8f34cc5c69721d5c90f2e3d090b9a9d9867da39c77d972559f51be3df7687143acd
MD5 SHA1 SHA512

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 484B
SHA256 9fd2b7fae87c2d863b486a425834283f19b1444749c84650d5a48c9eadb12e2b
MD5 e9289cc1f579fdfa9d46acfae9b38330
SHA1 7eac8e241d8c35d873280d6b9dbc1cca7a9b2231
SHA512 b1f37da50e387c8408a960ef5276a51336510286c1db7eaea4cde65af4efc343f8ac1d9de65df1fd0818513823a485733e5c155da615344bc044f46021ecf586
TLSH
T134F0543C33D821A4F08C46B23596ED8B88BF313247DC2631CA50F550315387701B5095
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 16fb2e8964790c8d48deff7fbec75ce0ac065c3759bb1a9971f40b10133ce500
MD5 f2e7091b7dfc49f713c574b3be6fe07c
SHA1 ef2aeb930be22aa8391292a322a9ecbc2e74a2fe
SHA512 a81c3704ba2e69f5a31e6a193689b1984c087fa852dab119a0824daba39ff3f6390fe61b0f746771c95cc95ef3980ae5b7f9bdf77f085a064a99b3a60ac01030
TLSH
T147411A6CA6F91154B3B77F4AAFF6A86E487FB9372E06945E10110D4E0A22F01D862737
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download