hxxp://bing[.]com | Triage™

Analysis

user interaction
yes
max time kernel
599s
max time network
562s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://bing.com
Sample260907-wheqmazzcy

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3312	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134332773150893894"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{1382EE03-29D0-4937-B89B-ABC9A30E70E5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1336	msedge.exe
1336	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 3332	3264	msedge.exe	87
PID 3264 wrote to memory of 3312	3264	msedge.exe	88
PID 3264 wrote to memory of 4420	3264	msedge.exe	89
PID 3264 wrote to memory of 4420	3264	msedge.exe	89
PID 3264 wrote to memory of 4420	3264	msedge.exe	89
PID 3264 wrote to memory of 1944	3264	msedge.exe	90
PID 3264 wrote to memory of 1944	3264	msedge.exe	90
PID 3264 wrote to memory of 1112	3264	msedge.exe	92
PID 3264 wrote to memory of 1112	3264	msedge.exe	92
PID 3264 wrote to memory of 1112	3264	msedge.exe	92
PID 3264 wrote to memory of 4160	3264	msedge.exe	93
PID 3264 wrote to memory of 4160	3264	msedge.exe	93
PID 3264 wrote to memory of 4160	3264	msedge.exe	93
PID 3264 wrote to memory of 1792	3264	msedge.exe	94
PID 3264 wrote to memory of 1792	3264	msedge.exe	94
PID 3264 wrote to memory of 1792	3264	msedge.exe	94
PID 3264 wrote to memory of 800	3264	msedge.exe	95
PID 3264 wrote to memory of 800	3264	msedge.exe	95
PID 3264 wrote to memory of 800	3264	msedge.exe	95
PID 3264 wrote to memory of 832	3264	msedge.exe	98
PID 3264 wrote to memory of 832	3264	msedge.exe	98
PID 3264 wrote to memory of 832	3264	msedge.exe	98
PID 3264 wrote to memory of 4868	3264	msedge.exe	100
PID 3264 wrote to memory of 4868	3264	msedge.exe	100
PID 3264 wrote to memory of 2348	3264	msedge.exe	101
PID 3264 wrote to memory of 2348	3264	msedge.exe	101
PID 3264 wrote to memory of 2948	3264	msedge.exe	102
PID 3264 wrote to memory of 2948	3264	msedge.exe	102
PID 3264 wrote to memory of 2948	3264	msedge.exe	102
PID 3264 wrote to memory of 460	3264	msedge.exe	104
PID 3264 wrote to memory of 3612	3264	msedge.exe	113
PID 3264 wrote to memory of 3612	3264	msedge.exe	113
PID 3264 wrote to memory of 3612	3264	msedge.exe	113
PID 3264 wrote to memory of 3548	3264	msedge.exe	114
PID 3264 wrote to memory of 3548	3264	msedge.exe	114
PID 3264 wrote to memory of 3548	3264	msedge.exe	114
PID 3264 wrote to memory of 3628	3264	msedge.exe	115
PID 3264 wrote to memory of 3628	3264	msedge.exe	115
PID 3264 wrote to memory of 3628	3264	msedge.exe	115
PID 3264 wrote to memory of 5052	3264	msedge.exe	117
PID 3264 wrote to memory of 2868	3264	msedge.exe	118
PID 3264 wrote to memory of 4876	3264	msedge.exe	119
PID 3264 wrote to memory of 4548	3264	msedge.exe	121
PID 3264 wrote to memory of 4548	3264	msedge.exe	121
PID 3264 wrote to memory of 4828	3264	msedge.exe	122
PID 3264 wrote to memory of 4828	3264	msedge.exe	122
PID 3264 wrote to memory of 3316	3264	msedge.exe	123
PID 3264 wrote to memory of 3316	3264	msedge.exe	123
PID 3264 wrote to memory of 3316	3264	msedge.exe	123
PID 3264 wrote to memory of 4952	3264	msedge.exe	124
PID 3264 wrote to memory of 4952	3264	msedge.exe	124
PID 3264 wrote to memory of 4952	3264	msedge.exe	124
PID 3264 wrote to memory of 1464	3264	msedge.exe	125
PID 3264 wrote to memory of 1464	3264	msedge.exe	125
PID 3264 wrote to memory of 1464	3264	msedge.exe	125
PID 3264 wrote to memory of 3772	3264	msedge.exe	126
PID 3264 wrote to memory of 3772	3264	msedge.exe	126
PID 3264 wrote to memory of 3772	3264	msedge.exe	126
PID 3264 wrote to memory of 4748	3264	msedge.exe	127
PID 3264 wrote to memory of 4748	3264	msedge.exe	127
PID 3264 wrote to memory of 4748	3264	msedge.exe	127
PID 3264 wrote to memory of 3268	3264	msedge.exe	128
PID 3264 wrote to memory of 3268	3264	msedge.exe	128
PID 3264 wrote to memory of 3268	3264	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://bing.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffd22cec188,0x7ffd22cec194,0x7ffd22cec1a0
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,5961545200281601814,16258303664216318438,524288 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,15842765232121363890,14230386219779351972,262144 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,14244185585348986204,16784842854063013331,524288 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,212526608749557397,9619383936271374784,2097152 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,3338629219238986051,17058661503970839864,2097152 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,3375365606918116990,331868144280633461,2097152 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,363835336112115788,8693377835486447917,2097152 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:2
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3620,i,692856721949954087,3999768940793470664,2097152 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,17987955973207125285,9116664351312190950,524288 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,2436044050092610096,10238430907725505875,524288 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5944,i,8926001923152215424,15595085615873312566,2097152 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,18427122362087679138,9026927732469182775,524288 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,18427122362087679138,9026927732469182775,524288 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4300,i,5527694914178976809,18180385421428338598,2097152 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6204,i,6155917144934878690,8484971900806088889,2097152 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6452,i,15595196517200473264,18256717949481336396,2097152 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,14264883692636720301,8219340992302674211,524288 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,9899266811414438412,1955143774899681806,524288 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,5483485134096144814,352184716021878204,524288 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,16219592479221615556,5667889499550210140,524288 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,1681027421968008549,7396657755928917490,524288 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6824,i,772370242280973388,10616372104478260250,2097152 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6892,i,1178210737248697308,10479035063413671348,2097152 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6020,i,3812552790162907784,16250596386476107524,2097152 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6920,i,13669583758439719335,23850949419172975,2097152 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4864,i,6438118545103667326,4012203272658171839,2097152 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7060,i,3843944089905902976,546306260942580031,2097152 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5332,i,12374562006350151918,11556544144655354262,2097152 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5540,i,1452661665643152029,14010165945315272229,2097152 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6448,i,7920497101380880712,13095171302437214857,262144 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,5233246688634143905,15558875438646345040,524288 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,15525646502628717947,14773239264324480110,524288 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,2732599657274598565,17550170801103482177,524288 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,14649571744379642854,1045838385960522803,524288 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,13104262449841532195,8816706379003151626,524288 --field-trial-handle=2260,i,3905451173367282944,16910764218202358045,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:8
  2⤵
  PID:3240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 64fdfc119bd22f6533d9b15bb1734c0f230ddb2015894c9c1b0860c4787396d3
MD5 9d02b246969603be3480c62c44213352
SHA1 e782d034d530cb3ce829062fc917bd91b33003ff
SHA512 f04cd860a40b8a903ecb0185439e00429b49de4e81f68e492d81a2a4393f57a0714ee62a2d24d6554b6a0005776222883830a0b7b4d13621b3ea9469b2f1488e
TLSH
T12EE07DC505D9D22EB700B64B466C6B0CC2E03B4AE3CC6F0E3B188C89BE87041F2D26B0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
TLSH
T1055302E4123CA75C49FC43EA5434D635BA4B31ADABD4102FB69BC4258F6EA824447CFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 18KB
SHA256 78436c050e6f85c1852f73cd14c82a19a303e62823445f95c31ee9573d29296d
MD5 db1c19ac49eca9c1c221dc55767687c0
SHA1 8b5356e508aaacd2984d20bf8b3dd602cdb855ab
SHA512 3a5a65f7e52849f80e318605e288b9951dd807922c1701b5630ffff6c873e6ad01f3f753336f935d6669b837ca9abb46d4055291e8262774f4845d98cb9a2f33
SSDEEP 384:rEPJ0w8GcAYP+Wp4QnMwa3aZIobctdAEoy/CYMS8Pgk2:22dGcAc14iMnEIo256Y8Z2
TLSH
T12182E1955A50A2916CB0597138E33D0333BC45E928C96E1ED9B7D623CFE5B889841EE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 66KB
SHA256 77df21477abc909a61db33e0f54965cdb1588e475d46dee935168b4721f73152
MD5 6c69688b96be5181ec89806cfa8d2b4d
SHA1 3644a8787779e8923fea45158afd682122665301
SHA512 d69d561629563334e5349e8fc844ee492c0e4eb67fed5de624282497c26efa0156d75547e7e47e3aeb7a8cb66a912f641a04b12e8f77e3466ed615bd7cbd36bf
SSDEEP 1536:DgUqrxl8iiX9x05j5QZPF+HX7wuxcDH+DphcgQBH54tA:DYxZRjCZtm7wux5pGkA
TLSH
T1446302B0BD7247F8E2920C4997B1858633681B755ED8B963F4704DDC660DC16BEEB350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ac

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ac
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ad

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ad
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ae

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ae
Size 68KB
SHA256 fc70b88dddb2da85326b7ff7e1fa801f0099e5c0d3a85863afd2737af9b199a2
MD5 cb3d1e69fbf9c94b15e92f2fa26892f0
SHA1 b8e5aff1547d49a1285e2e0c4cb43dcd9993f468
SHA512 0f890af69b223aaec8bbc753bbc626f6cf0e0660182e38871a03337f1eec7be6b47cb9d5034a3cb8c226feb6cd964d396f56fecf07257f3cbc13de642c175ac2
SSDEEP 1536:1RrPSv8UR94fNhLVxko8PojNVcL7tk9/yGeJ3GI:PPZGefNhLVxko8MrcL7fJWI
TLSH
T16E63026A7FAAA437FB2C87016FF23034D1F8FD579034042826515BB5A4578E92326F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000af

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000af
Size 43KB
SHA256 14ef713f8c26bb48eb58aee7291d24bfec7fe04461af055f0c9ad63a298c5a93
MD5 e7f31b312430a58beebf02569971cecc
SHA1 6a36445d1f2bd9ded564f13fb047b896f1ada7db
SHA512 f069e3981fc381c27bb2f3c1a36251142fce8661d614f92058b9418def9a950323957fc9df7453bb671b7639869542656cce9df96e0b45e6e12a6637ebc6e1d8
SSDEEP 768:3CZ1Qapm3DP4Q8Ag1BGBa0p/PE+4dxquLkDOBFwQ4aUjnlxGR/Yy:SZ6a43DP4RbGBa0VPE+pWkDOBFwQAjne
TLSH
T154130200E0F0CE82941B5C8A0D78948A7B210AD49EB5737486E8DFF7C51BDB8C6DB05B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 510a8533ad5f3d497028cc6eb1c754b68fb328bdebcab8dc8a78bca0702f0050
MD5 a53eb6414ec81e54adc913407550100f
SHA1 8497e792c3fdb82e77a096f6954bbe3e233ac0c0
SHA512 de831f9a33d2635f6ae803b3be14db895ddff5e33c5096fedcc8adf4b31d5130de17afe2729eb6862da6732b9124f75bcc5449315d510224b84d46b7417ed611
SSDEEP 96:iGklqquPSWzmrVLjTKYetb3eRfRFBBLY1mrR3KsCMxFbwVNsLmIakhXJFuk5dmiD:i9ePi1BTaFNMwkFbPmwsM1WFe
TLSH
T155E11DF48BD9689EFF9E89B5C8E81A8339FF44D9F7373E460040E5341E16BA0151692E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 1d25d9488d8a593052ebb854b0adf9955700afa7cd540cce0291d7f11acec4f1
MD5 cba00dcb8756251ff2c9c111d87c5772
SHA1 471a401f76ffb51e68df8b2ac224fd7f831c686a
SHA512 2f8cfc0d23a2b9365530cb880cf70288b5851440232ff650804e05725a2fcc714d0ba8bae08da5449ec0859843db462a16ae738a7c69a69046c1483c6dc75632
SSDEEP 96:1GklqquPSWzmrVLjTKYetb3eRfRFBBLY1mrR3KsCMxFbwVNsLmIakhXJFuk5dmic:19ePi1BTaFNMwkFbPmwsM1Wq4
TLSH
T116E11EF487D9689EFF9E89B5C8E40A8339FF44D9F7373E460040E5341E16BA1151692E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 03cfe132c1ba3a89b17df4054b7ae329f58f62b1d1ff247d7012fb8e90ccc467
MD5 c101fef926ae576e3632fbccc830cf79
SHA1 47ea7909d9e1c7c9a0623499890902a8a8af125e
SHA512 3a47b0bf3b4c90f173b8f40661420cd6e8993a6c1fcc42d63136f9a65e6c54a0276f3e2c05da350e2cdf24b3e557f7ebb93e306f3fe25fe34fe1f5772e24d397
SSDEEP 96:leyklqTa6WymrVLjh0Yetb3eRRsHBByg1mrR6OsCMxbbwVNsLmIaoh1JFuk5vNqP:leFUalKBgVHNMwoPbZNIvNqv72
TLSH
T12AD1A6F88BDA699EFF9E89B1C0E51AD339FF44E9F6333E460040E9351A12791151642E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 1770a9bc676ade9e9d79921820902beb2ef1072acfe8856277882736621493f8
MD5 4cac1131bb53d3acdb9062dce771955e
SHA1 4dd772b8fa73f1e3ceae4fcddc24283c0ae6456f
SHA512 6500d57054c4ecf2638754b7a2f66bffdd1846528a264f33937d3c5df3596486a8086d04582c4a35e6ed49c6c4e37c6e5afd9b5d4c88dcbede2d8f02c6a2eb80
SSDEEP 192:D6Nn37QrEJHS1yCGSudNFux2N4Hlig4gHYUY3GUll:D6Nn37QrEJHS1yCGSudNFa2NSlig4gHQ
TLSH
T14DD1BCF7CBE8866ED91151F0AA183E1BCE1D0955432C3C5AC4E8EF5BA3E2070E144A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 238705e8428092fa2f03f37ecbd69a94164186aaeee40ced77a798c3761b1290
MD5 e412d3bd2247f1795c95542c688c051b
SHA1 b8430284ca8ba655a952c888f22de97817c620e8
SHA512 47ecb696c4a9e2c3ec556b1b903e77c2f4495a1be2aaec2985e8b3dada4b61b6afa74d53d360e33a28f4d355b93adbb7576bd69ea2db5df7fea7ffe34d102f1e
SSDEEP 96:D/OC0cjsZEJHDzByoGSudN612NwB31iEB4gHYUGvUliGj4/3:DWC0cjsZEJHD1yoGSudN612Nklig4gHi
TLSH
T1A3B1AAF787F4966ED91151F0EA086F1BCE2C0815436C3C6AC5D4AF5BE3E2071E184B8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 865796b8ea889267729bc796b294b399cf02492f7a008d03b97a4441b58475f0
MD5 bc0b6e6ef6024b7c0942dec07f147589
SHA1 81d85954338af04df2dff5800a8fbe21738cfac6
SHA512 ac972796f04d0fb73a048b426b2fbc48e12d5bcb5b6fc24c297b86e033bc303b2f8992b1f912f9d7bbe48ad16adc30672d45312c1c435e65c3a6ed05ee30c2e1
SSDEEP 48:YALlNFOC8HC8tC8cIC8J8x8SBCFsczBC5C2sDCNC/CvksGCvs3CnCXEsmzC+dHz9:DjONn37QPSzByCGSthiESzvdNFuxnGwQ
TLSH
T15291ABF3C7E8966ECD1152F0AA187E1BCE1D0955832C3C5AC4E4EF5BA3E2471E144A9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 d0a6be892384d222b55f85d9b1e7963bff9ee3008e9aec0748ec697e68c7e55a
MD5 1e211091648e93e544325ff91dcc3882
SHA1 7b0b2f9b5af7a1f9e9b9de58aed1631044bd978e
SHA512 28e0e90b62c9fc4b017845e36c1dbd4c8c9778c6020ecb4b399faf9b561e187799e55ffffc0595cb1e20ad9b0c2af4dd2711db888996a145c54822fadece9a80
TLSH
T151D02363170571B9967C7E93605AEC4ECB2610100C139DD514D0549D463556C0507149
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 1aba564ec3f26510952b08df5eab4d292a2cbb51364a79f12990a793662b14cd
MD5 8773c3a735de143d143520016fd471d4
SHA1 9c4ae230dd94bb67e6c2520db73e71bf94d74aeb
SHA512 c2bf70dcc992858658f0413a26ee8d23ee87f7d1a143c6f1e15cf6bf4288bf917f6f7e2e6c020938c023ff8eb8ca52b3484e47536e579f96796d1b6d4de2ae9c
TLSH
T19ED023231701717D567C7D926055EC4FCF2710200C53DDD514D05558473157C0A07344
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58c222.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58c222.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 93b1438b20a7585ba06af534c6d74221f4eee33ae37d5990d3cf39790b18e4eb
MD5 2bd838544cb0b803c643b1295ce1de53
SHA1 1d7557dedcc5ef06402616dad930608c81aa4f2a
SHA512 b1cff68a1adff3152859ebbb82166d848ab4f69460e8dc5231b712e2c88c7ede6e468d91c8dc44683713bdcf7bcf0365080d63dea9f2c47408176ea31155adf8
SSDEEP 192:sxZdRDkM/fzskY62TdpACkUHW6+WNi5O/YCF6V8AIgrJ:sxZdKM/fzsV6sHHbt/uz9
TLSH
T14B22D8126E78A9774CC6E21DBA15BF13E2FA503291951E58E7FC861C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 bcbe16b9e222e05917e7e5b051d16fca3a31f0a91d68e37eccef909b5c0c0b92
MD5 3d8ec33f1404d522383cb102860ebfd2
SHA1 0932c045205332e30b9ab5051a9893009c97c50a
SHA512 b92d0a34466c5552d19fc6c0b8eb537e1e10f2af2858a926786ce3c9e2199e8b1e9f6e869c614e92f575591ee48b65975f569d2a8bd31f7756fdae8df4e5f392
SSDEEP 192:sxZdRD0cBzM/fzsMYHLXd2HdpyCVrM7H056+WNqth/HZHdYC5t98AIg5Kw8DzZtk:sxZdKmzM/fzs9HJ2zkHlmRdxzWnZO
TLSH
T10A729592A528E5775CC6D90DAE31BF12C6F950338C911D4CAAFCCA5D06DEAFD220B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 867645f71ccd6d838c968aa5f978c754a3be4b11841e7c7bdae5e9d56fa456af
MD5 206be8c491e04472554dd3dc5297721c
SHA1 31275aacaf824cda6ead1b20e3bc14d42e4d8072
SHA512 0171b953049eb5a4ee7482bc3dbf62e0d31db7834829db8f2ac5928cd7fcfbb0d48b4b18bcca10b507ba177d72ab6f3654e9389149d4a4218e08ab10f7272fd8
SSDEEP 192:sxZdRD0cBzM/fzsMYHsod2HdpyCArdgwaH056+WNqpbh/HZHdYC5t98AIg5Kw8DM:sxZdKmzM/fzs9HR2zJHlGRdxzWnZO
TLSH
T174728592A528E5774CC6D91DAE35BF11C6F950338C911D4CAAFCCA5D06DEAFD220B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 29KB
SHA256 84dc7d33326c5c16baf5d841f57addfff2e24d2ac194c5c204fbda16952ce131
MD5 af7fc4967684b1d88e2012b796f8f743
SHA1 4af7465194ce515dfb7d276e406fd73614376942
SHA512 1ef262a1c52e5e6eaf36c28198ea0e6295b7f1a5db40102c4400fcc5b017e72a5fbec719b654e345e9ee87a7d7cad756c8601120017ac91fed2eacce6a2538a8
SSDEEP 384:sxZdKmzM/fzs9f66sjqMpRiYnazAW8pZS15posJWeT+7R2zJHlGRdxnoWnZO:slKmzM/fCf4nnc7WeT+7R2FHlsxn/O
TLSH
T1B7D22982A424D4679EC39D1C683C7E32CAEC50635985DEDE5AECCA1C02DE5FD6B0B853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 da4493f788c65bbe6c0f9ede02bf04ea5c0db6895c4669cd616be90f6b0e9798
MD5 0c3c6ba536a186e71833ccac63921f6a
SHA1 4afaceecb1d674cb0b6c2b17aac252e302cb635f
SHA512 e22da1ea416270effd083aea09ea5fb191471ca7c5bd34425fe1d10bfb67535acc9c1dbc53e71c75b9bedca85f4a6c28b5f67d8d40e915b27c958541d5098908
SSDEEP 192:sxZdRD0cBzM/fzsMYH1d2HdpyC9F7HW6+WNqRFLXYCMt98AIg5KPzZtS9:sxZdKmzM/fzs9H/2zDHbEX0zIZO
TLSH
T18362A792A528E5775CC6DA0D6E35BF12CAF950338C912D4CAAFCC65D06DE6FD220B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 eb7ae9adb8985750c75b1d42aa847606c942a096689bf537535f1cb7add0e8de
MD5 26cb8721da9f2049245df680d9fef849
SHA1 b2b5c21ad642a258f23ff5918020f54168995f93
SHA512 637c7992805f3fb347752924db5e01abd7fdaf58c02176613875362915fcfa55c956eb8d93a56e0a96f6660a8ead30df8742da43081e885e9625ed1135eed2cb
SSDEEP 192:sxZdRD0cBzM/fzsMYH1TdpAC9F7HW6+WNqRFLXYCC6V8AIg5KPzZtS9:sxZdKmzM/fzs9HhtHbEXhzIZO
TLSH
T11B52E9526A28D5778CC7D60DBA35BF12D7FA503299911E4CABFCC61C05EB6ED220B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4a8ae4fd3fd5c649aa8133571ea1e330ea8f129e2aecea7f8c058726d1a4a46e
MD5 6dc94a6f5e55daa5faf84afb77e3c592
SHA1 59ce644ddc6937d1ba4f430176eb4a7a26422a78
SHA512 1a6cf12de54e493ec86ef6c77ed53ea293bb282175534710cfbc3ac2657460022ca42a0e8f4cefcc32aff22a3fabb1969af0cc511bc38beb6af28b67b76decf4
SSDEEP 192:sxZdRD0cBzM/fzsMY6YTdpAC9F7HW6+WNiFLXYCU6V8AIg5oPzZtS9:sxZdKmzM/fzs96itHbcXLzeZO
TLSH
T17B42D8526A28D4774CCBD61DBA35BF13D6FA003299911E4CABFCC51C05EB6ED220B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 484b79a2373ea4f31b5f7606a567b478e715fc439f3815a559fe93fb6af4cc58
MD5 485c260e749eebdc042bbaf967f6dd47
SHA1 190fa2f6e1054cc6fda2a6f315b606ad1e2e95d1
SHA512 153b352e7aa7c5b2583aa8bb2132510d2aa080b199b7015dd66c35af6b1861dd3b233fef8ea421dbc32596759c640d2a8657d44fd0a82852252b19dddf4ea5e0
SSDEEP 768:KeqbUj+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKrtroU:KeqbUj+WvSCs6u1jaaZLbWrGU
TLSH
T109C2E93B340CCA7E4F801E9DDD5A6F972EA802C7A7588D4447FA994C02C77EA512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
Size 816B
SHA256 31ca7f207f549c24ba64332c4ca602a08f4de27b00707c6d5d4ff2bf9bfb96d0
MD5 5a92608abcc19130ad5e0ff0f910fe4d
SHA1 c770a94a63b5a24036b9b527eb4635b1b0970ded
SHA512 0123512dc043943bb39769ca830372e4e8e4a91753942e133b8afb484ce3c87d9a6d8c61ae08eb1d2afe6798fa54b324719ad2e25f4ae0c54beb757ed6451903
TLSH
T186010C9A5EE64C2FDD540BF304B974F473B0C9DC6721E263583E21272C363C969160D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ce3d0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index~RFe5ce3d0.TMP
Size 816B
SHA256 b5e19dd6438dca82a4129edee1459ab771bda88c50f886e5b7b53cb217c22a3d
MD5 323b4f7840d8dce79e87462ba6f6e59a
SHA1 c60b3250ec8bbc3423a8ac791407e673713ec36d
SHA512 01bf1c6c280e5a31dced0e5ee535fa216b46a8c148f142f4eaf5508883abe1eabdb1064528048955e3ead1b667c17ec55b180738499434ea205689a52c311087
TLSH
T1060126878B964D1FDC4406B7458960F47375CD006332F793947E253E2C7A7895D470C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 cd2ececd37a4245da199f09f77b0ee7c502a3dfb00ac379178cf1c1ea0b20c5c
MD5 5dcf30d9ab2c39216b77468efa6f5008
SHA1 b86194a1c21d2a926f28f0a3c695dde90c9e9549
SHA512 3e327b4b8997bb074855ab26114a1cc39fc0f21e2a7ac2a665d5a6d48bda8e88cdc37a6ccfb205932dc28e66a3f87df2699f6e3b077997449059510f03098eff
TLSH
T110E0D8BA29E72864BC7BA3FA247058E002597998C98AFC9E1069A1D750B3361385AC61
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ca44690f852830e4c9b4eb9a49623b7f21b145841301e11397a52484da566a7a
MD5 587eaf57c461f62bc7c2db18046bb2ad
SHA1 e8662994844c05c40d47412eae805e854cb6a92f
SHA512 d20f365621a956aebfe37aa872be12fd33483b7008eece7c90f6d78b9799fcb5795d403654767a261d2bcc0340e58bc5bcd524f806dce5bc70d763c0d6a6b4bb
SSDEEP 48:KQJI5Ky8sjyhOIXKzacnyhjgXz1xFgRZSzI+bgKz1btgHrwsCNy:KQJSKy8KyOIKzam64YKBWT
TLSH
T1B491EF16703A4292687E2588F3579A361F4235A33254E86F3FB808A21F67E121CFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61321b06-ef99-4a30-8f4f-ec067ca4f5ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\61321b06-ef99-4a30-8f4f-ec067ca4f5ba.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1f986c54af74c2ddd4efc80aa1acedcabfa2250897eab887465e3ec19093d635
MD5 a2eb66642061abb5845f2863c6ad60a8
SHA1 defd03b6a1dfdfb9c59e4ed419f69cf53bcc7572
SHA512 4cb9d4e06763cf211058dcc18e03ed69262850d515a9a38032b320a588a4b245f27bd4e4c303069b2b52895d4cae59e7deea3d48f1f6254d5afacd9e76763cbe
SSDEEP 384:sZcIhsNIHXYdZvEa+SdPId+2hb7O6R2FeouFo+:6h2can2dlhb7TRRZ
TLSH
T18D828F715C7C5C7759E7A15AF88736139FF8806786CE2A81D5ECAF0D01DAAA8130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 35ba9f9056fc85a4931ce478cb81e61e12000b33a015494af8e55bc9bec5af8b
MD5 293fdeff67e0a97cf7d86cad0daf740f
SHA1 d35f75abae5e88cbf49063da9eef630c4de10bab
SHA512 5d89079c4b4123c84b6240bdab3dc7d27da3c158fa176a65d7a9d4efc0c10593ab8e02e7978f03b259a996a6246556c811fcc742a5e781793faf027bb238c928
SSDEEP 384:NiFiZcIcsN48TUNTUlIlHXYdcw2Ea+SdPId+20b7O6R2FeouFo+:EFQcVwgFwlan2dl0b7TRRZ
TLSH
T1AEC22AF208EB887AD9AE5747A77E2E038EBCC053B5856541F39C5A0DCC965BFC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 578226c11d274274bb4bb00e2e43116811aa83712d50eaf8bbaf5f93f6d74ffb
MD5 c085357e892da004102cc1aa9e40d954
SHA1 2a8c4cac254bd4119a8c9cb9772e92d027486ea6
SHA512 a8aa36d5f9114564f5dc035fd87d7a5d57d7e05b6c179ada2652409c5e39d16bfddc7bd1d1195e35abf0c8d5e2fd794c9535774b23a71f656260c50fa0670d5e
SSDEEP 192:vONGV6Db6QmiUy4YHBa+jx+FdCYHojRgLipU6:vONY6uqHBa+SdPIaepU6
TLSH
T17B02D83568786CBB9EF26E49F8872B239FD4106BD9962B45DAEC5F0C00D765C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 23d24bead17881fb7833a0bc012404fe6140ca8669800d4b4fecd822fc764be3
MD5 2bea64373285c7692d602c42ace63b0e
SHA1 0d301cbba38e5760399f75fa0b0539f234f0604f
SHA512 80c1a4584c034a4788e95bf7647888cda23bba56e3844c4b6e92cb1d65cc59dc552b137bb110819061ac38099ebf39feb262331b48a60f954fa654e7e7126068
SSDEEP 192:xONh6DbiQmiUyhYtBa+jx+FdCYHodX+2zNzpquU6:xONh62ltBa+SdPId+2tbU6
TLSH
T1DE121A36687C9C7B5DD26545F48736139FE98127DA8A3B91E6EC5F0C00EF65C130B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3724722b2f32005ed086e8cda58adfa4884bae2116ba235568387afcaa1e2440
MD5 f32b2ffe76c0fefba44d8bb27b110039
SHA1 e7a64b243c42d451da7116a77c47aadd3273992a
SHA512 92690df631f6a92858af2fa567c766554719cfed7d6fcfe0a04a950aaa7adb2deb915f0dcad7a2aa9bf4a365af242a69f59cc0c5554c5f9cdf9b1fb4c931d60a
SSDEEP 384:kZcIhsNIHXYd7w2Ea+SdPId+2hb7O6R2FeouFo+:Chwwlan2dlhb7TRRZ
TLSH
T1E1828E715C7C5C7759E7A159F8873A139FF8806786CE2A81D5EC9F0D01DAAA8130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 20289927f0bb97c792de9d949aa8c292f4f492a7d0e21b8a678ee1c6ff1ac5d3
MD5 eeecce139c451b034979b5b064427804
SHA1 e5af82e82c0c9d2222b6d09cbbfcfb8c7b63d01a
SHA512 4638a5f88118d40de541f49a4c5f38e234bb438b0c1aa36ce071290437aa142806a7082d161361c27091663a869b751ef28e8f169904746da893e4db04839004
TLSH
T142E00212970040BEC03C57718C93593435D2507442B601449F15117528533006B507C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 cf7cf8a2fdeb9c6487e5a57e3f7221351832c2e42e4d620bbb0c34a8a2985386
MD5 cc97119f3d36549568fb4989a8a4d36f
SHA1 69651534e9dac68d3b26b747c0d4a275a7389917
SHA512 7787250b9a71b328f5281863887f60449ce308c22800a7372c02fe36a9f0e8e22cf0b8a0edc11fde813d7d784b415d3b2a8b0d9bfc48b99e2ac040fde2d0a383
TLSH
T118E00211530000B9C02C573104435A2006C2802041F502559A1111642C533006A20F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58cb3a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58cb3a.TMP
Size 392B
SHA256 8c0be5017fc91815fa9e2dae3c18da9d95389ec87135f319d6226cf5a9e27a27
MD5 84af3af5ff151b55abf0702afd96719f
SHA1 02d6f50c102faaec6a46f61e21f642a8612e1d4e
SHA512 c87bed31d05506f4269a4542b1f1fda1a44d1ce398507fa1fa3b7f50f0064bc6174601683dc0e57b7828307033e002e64a616776a8f3daadd51af82af6ff3d9d
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8132f2de0caedf19516ad359985a0812772236dd140264589c9306fa156cd259
MD5 cf878eef5fd29f58ed1c961e3876c03b
SHA1 899f066a87c435d3b41cf845dc0f25d8eb1815c3
SHA512 cf075a45a910bd907cc78ebb31aa88940462efd23c932e6d70c643eac22a67f720ad39b23e694facda4cd02db6e0eced5595c68718ee7c138a2c9d2cca81156d
TLSH
T157412B58AAF91148F3B37F5AABF7A46E487AB8772E07D49D10110E4F0663B40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download