Analysis
- user interaction
yes - max time kernel
56s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/04/2026, 05:53
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://upkbn.buzz/lGgsPEiBO/my-en?0418576248704616522&s=wa&
Resource
win10v2004-20260130-en
10 signatures
150 seconds
General
- Target https://upkbn.buzz/lGgsPEiBO/my-en?0418576248704616522&s=wa&
- Sample260418-glb2kshv2z
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4652 msedge.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209652005924671" msedge.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-312252282-3884318443-358092420-1000\{7A0809DA-0F5F-438F-91DC-CE632660A623} msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe - Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 4296 wrote to memory of 2256 4296 msedge.exe 87 PID 4296 wrote to memory of 4652 4296 msedge.exe 88 PID 4296 wrote to memory of 4852 4296 msedge.exe 89 PID 4296 wrote to memory of 4852 4296 msedge.exe 89 PID 4296 wrote to memory of 4852 4296 msedge.exe 89 PID 4296 wrote to memory of 4664 4296 msedge.exe 90 PID 4296 wrote to memory of 4664 4296 msedge.exe 90 PID 4296 wrote to memory of 4376 4296 msedge.exe 92 PID 4296 wrote to memory of 4376 4296 msedge.exe 92 PID 4296 wrote to memory of 4728 4296 msedge.exe 93 PID 4296 wrote to memory of 4376 4296 msedge.exe 92 PID 4296 wrote to memory of 4728 4296 msedge.exe 93 PID 4296 wrote to memory of 4728 4296 msedge.exe 93 PID 4296 wrote to memory of 3716 4296 msedge.exe 94 PID 4296 wrote to memory of 2464 4296 msedge.exe 95 PID 4296 wrote to memory of 3716 4296 msedge.exe 94 PID 4296 wrote to memory of 3716 4296 msedge.exe 94 PID 4296 wrote to memory of 2464 4296 msedge.exe 95 PID 4296 wrote to memory of 2464 4296 msedge.exe 95 PID 4296 wrote to memory of 4592 4296 msedge.exe 97 PID 4296 wrote to memory of 4592 4296 msedge.exe 97 PID 4296 wrote to memory of 1164 4296 msedge.exe 98 PID 4296 wrote to memory of 1164 4296 msedge.exe 98 PID 4296 wrote to memory of 3580 4296 msedge.exe 100 PID 4296 wrote to memory of 2268 4296 msedge.exe 101 PID 4296 wrote to memory of 3580 4296 msedge.exe 100 PID 4296 wrote to memory of 2268 4296 msedge.exe 101 PID 4296 wrote to memory of 3680 4296 msedge.exe 103 PID 4296 wrote to memory of 2492 4296 msedge.exe 104 PID 4296 wrote to memory of 2492 4296 msedge.exe 104 PID 4296 wrote to memory of 3708 4296 msedge.exe 105 PID 4296 wrote to memory of 3708 4296 msedge.exe 105 PID 4296 wrote to memory of 1424 4296 msedge.exe 106 PID 4296 wrote to memory of 1424 4296 msedge.exe 106 PID 4296 wrote to memory of 3544 4296 msedge.exe 115 PID 4296 wrote to memory of 3544 4296 msedge.exe 115 PID 4296 wrote to memory of 2820 4296 msedge.exe 116 PID 4296 wrote to memory of 2820 4296 msedge.exe 116 PID 4296 wrote to memory of 4032 4296 msedge.exe 118 PID 4296 wrote to memory of 1440 4296 msedge.exe 119 PID 4296 wrote to memory of 4968 4296 msedge.exe 120
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://upkbn.buzz/lGgsPEiBO/my-en?0418576248704616522&s=wa&1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x20c,0x23c,0x240,0x214,0x260,0x7ffdccd3c188,0x7ffdccd3c194,0x7ffdccd3c1a02⤵PID:2256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,17401154348009820281,15788763697278045424,524288 --field-trial-handle=2296,i,8900612127470575958,2154235644176822177,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:32⤵
- System Time Discovery
PID:4652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,15083441001992570707,18025957173956016757,262144 --field-trial-handle=2296,i,8900612127470575958,2154235644176822177,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:22⤵PID:4852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1360,i,8660357530112876562,9210431419734181293,524288 --field-trial-handle=2296,i,8900612127470575958,2154235644176822177,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:82⤵PID:4664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,2326899245405466832,6186964737869513181,2097152 --field-trial-handle=2296,i,8900612127470575958,2154235644176822177,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:12⤵PID:4376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,15214289327366428832,2364162265443475512,2097152 --field-trial-handle=2296,i,8900612127470575958,2154235644176822177,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:12⤵PID:4728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,14902244323854841659,18208555787888403881,2097152 --field-trial-handle=2296,i,8900612127470575958,2154235644176822177,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:12⤵PID:3716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,17453417311375823670,5572688696579931488,2097152 --field-trial-handle=2296,i,8900612127470575958,2154235644176822177,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:22⤵PID:2464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,3042824294795427147,8610510170548130193,524288 --field-trial-handle=2296,i,8900612127470575958,2154235644176822177,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:82⤵PID:4592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,16683327845580215874,13409897214288555632,524288 --field-trial-handle=2296,i,8900612127470575958,2154235644176822177,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:82⤵PID:1164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,11943680698332524131,14657707354794554893,524288 --field-trial-handle=2296,i,8900612127470575958,2154235644176822177,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:82⤵PID:3580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,12753717972788735910,12367213892865102289,524288 --field-trial-handle=2296,i,8900612127470575958,2154235644176822177,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:82⤵PID:2268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,10890900546248879930,17142381603465862516,524288 --field-trial-handle=2296,i,8900612127470575958,2154235644176822177,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:82⤵PID:3008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,10890900546248879930,17142381603465862516,524288 --field-trial-handle=2296,i,8900612127470575958,2154235644176822177,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:82⤵PID:3680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,6863099481070002682,1860470853103753205,524288 --field-trial-handle=2296,i,8900612127470575958,2154235644176822177,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:82⤵PID:2492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,9958301056790647890,11957615562063290567,524288 --field-trial-handle=2296,i,8900612127470575958,2154235644176822177,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:82⤵PID:3708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,980538101236426234,811327297862764921,524288 --field-trial-handle=2296,i,8900612127470575958,2154235644176822177,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:82⤵PID:1424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,11861842634308846666,16968562898778371674,524288 --field-trial-handle=2296,i,8900612127470575958,2154235644176822177,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:82⤵PID:3544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,17623372550541255078,13806391011845987564,524288 --field-trial-handle=2296,i,8900612127470575958,2154235644176822177,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:82⤵PID:2820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,11514329805143435130,9258470174447525168,524288 --field-trial-handle=2296,i,8900612127470575958,2154235644176822177,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:82⤵PID:4032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,5515462354290159483,3270119204348256638,524288 --field-trial-handle=2296,i,8900612127470575958,2154235644176822177,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:82⤵PID:1440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,17246971667454807282,12839485471366444889,524288 --field-trial-handle=2296,i,8900612127470575958,2154235644176822177,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:82⤵PID:4968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:4060
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
- Size 105KB
- SHA256 bf6c7c1e310b8b7658a6486f9e0ec1988af55c64b0088c5e106c251843317694
- MD5 6bb43aa8140737557979467fe7639310
- SHA1 5d97e47df415ba67e13786711fbced4e9a750018
- SHA512 8fb6570faf81d07a766da4536ff22a42ad13e3b00e64c6a1957397e3e55beaa3c40660967c718a520b4ce2092c1a8ae7388506160f6ae5fbf696f9efa13a4bd8
- SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7K:fwUQC5VwBIiElEd2K57P7K
- TLSH T1F1B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 d084fddc35d62ab10457432373865714cd0577ad9bebe9188135998b9f802bd3
- MD5 ff587c8337b9997eb40f19fb41bffd1a
- SHA1 75e9be1412e32cbe6e960e041e872bbb48ab464e
- SHA512 d50cc729f4f047045aba003643fd356cb1ac85c1d90f9ed992f787f682a862005a91103e9e388ad5cbd4f884c2668a35a0e5a0d011d0684ef2d6bc59a10b1701
- TLSH T15ED08089D5B15C35D1D78CF1154B37067915C577DF42532274633C3C8C435919546283
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 6b65e3f6d57bee85b90392c47f2236ea7ffcfe9cba07ca29930764c7dacc0ea2
- MD5 726476576ad538c648305e214c389ece
- SHA1 03960d925aa07a6736b28a431ddf422fa8bba04d
- SHA512 7b99250e71a507574a7ea1c326ff4f687cffd7e1a0eb1ba5aa847f5b5e0c5d997dbef37ede7c2815a11e03b25f291a4f19173dd0aa9d22472d224e9b1d6349a5
- TLSH T11ED0808995F15C35D5D78CF1154B37067915C577DF42932374633C3C8C435D19546283
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\41e3c09d-583e-4a60-be0c-e283af00cc12.tmp
- Size 106KB
- SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
- MD5 25dca813dd764f2197142ef84bc5ce66
- SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
- SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
- SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
- TLSH T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 b59370be931c21ee727f6f98f0e7e886ffddacb263f68f80c4b8e53b3f954cde
- MD5 d5fa6f5b566ac8d73bd882576637b26c
- SHA1 e09b4bc3b248a04ea2149b597df03bccab2f9254
- SHA512 87cf6205f08b5350ddb81cce6e6a4343b334ac036a37654f9c8ceb5811fbc20a849edc99bac5afcc54378c98aa02c9eb69a29d1565c485c41cf31ff7f52fb913
- TLSH T1D671F85453E98D29FBE113B4D6D12489B3308F48C1571E2E36F1C23D4A35B5F72A4424
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589fa6.TMP
- Size 3KB
- SHA256 8bae811fe0e61f6a423a31cab12e0db88a49deace7253783669d7d16e500d82d
- MD5 3e7a30f205e699f7391afcaed8b4db08
- SHA1 63210e9aef21d90dce3cb3d953a776668bf09231
- SHA512 83a9a402fcbe69bb1d00ed688568923340ee97660bff011097228673b8d0527e9910df01d21c6b3e8dcf44096f03b2b2c1edd79982a2b12cdb074c3e43a78eaf
- TLSH T1A871F85453D98D69FBE113B4DAD12489B3308F48C1571E2E36F5C27D8A35B1F72E4424
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4296_876013051\CRX_INSTALL\_metadata\verified_contents.json
- Size 1KB
- SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
- MD5 738e757b92939b24cdbbd0efc2601315
- SHA1 77058cbafa625aafbea867052136c11ad3332143
- SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
- TLSH T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4296_876013051\CRX_INSTALL\manifest.json
- Size 962B
- SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
- MD5 e805e9e69fd6ecdca65136957b1fb3be
- SHA1 2356f60884130c86a45d4b232a26062c7830e622
- SHA512 049662ef470d2b9e030a06006894041ae6f787449e4ab1fbf4959adcb88c6bb87a957490212697815bb3627763c01b7b243cf4e3c4620173a95795884d998a75
- TLSH T1661121366E2FC4260AE00698DC51308AF92453ADD380850E35BCE42E5B744FA430631E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 28cc692d2b318c861c711dcf162ceee79462e454b13313c1b8ed4d516406ce3e
- MD5 5f2246e13fe5171520a139affe4d8701
- SHA1 8c2c02c580534dffe0e411a8e82d6cf60e6ba1ac
- SHA512 f1aa8924a3e9e757d213c4345b79ce6587ab7a377b56ebcbed46f297ec27e773c5d865fc4dbeb90ef7c55c3bf1568821257c9af63c1f00344122cdb5cb110420
- SSDEEP 192:sxZqRiyM//K1Ml8MkhP/fAsI3m63PG9IdpCyHW6+WNxJ//YJ1Db9Ig4J:sxZqAM5/fAsMmM++ZHb//2c
- TLSH T1BB52F9156A349A77CCDBD209BA45BF53D6F90573E2900D44AAFCDA0C04E6AED2207C2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 33KB
- SHA256 4f895f1ee32442f4c653f57d4928b29003df6e8575ae5816af7aacf48f2f64d4
- MD5 508ef494e22bfc1ab0c4d064cd47bf36
- SHA1 6e1b9bc0fd27b163e75c79a6ac3d60d4ac6d20c0
- SHA512 5c64b54b880ec0f062717aae1e3077d20e04af212650d075aa92ed9c444d999b1ddadaaeb93bbeb5f57e57ac126f247f488881e0a362e98991805f6c87296e7b
- SSDEEP 768:uXQv2sc7pLuLneqWve+l+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVTFLllnWhCroxGd:uXQv2sAEneqWve+l+u1jaOFLfWhZxXwP
- TLSH T11DF20B3B6C0CCF7E4F844E9CEC2A6E8A6DE8018B96D8895447FA490C03C66EF55175DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 6KB
- SHA256 892d408a31aa584b9705ff15b0eca2548cd10d95901494ff8915ea6af3f36aff
- MD5 eeaef9d5d121439093ddacf89611036b
- SHA1 eac8d04e30f0446c8a387e868747cc561d399793
- SHA512 83b8341ff5a7f246274280ee739cd0781d7e00494c1ff5ef198ba01fb71da8ccca13379be8002acab06af973aaecfed5e2d152569a79451499b4dbf8a6e9ab09
- SSDEEP 96:KkE4Kh6COTGKI8KicIKB2iiwKvKuCpeKSUT:SnR1rWjty
- TLSH T1BDE11421323A42412A3E3A8E84E1B61F96C171637559A53F7BBD44658F27E30CDFD8C9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 4d02cdee656bea7b6d7447a3e60a1fc93ac625c550a7e9fb5b9ed541ac42de8e
- MD5 e096306cc802081bf098ddb7e0c3312b
- SHA1 3f406fc76a7d4bbbd186388755fb691e177f17e9
- SHA512 0ced82b5bf4e4106b168f2b18ab4345357206110d44e95744261f00b1eb0b5c5d6fc0b7d66a3f911089232d3e7e3a165dce5dbecfe351015f89b63fa4eade251
- SSDEEP 192:uu2rLsNbyQX6CT0PUX9QmiU1qY9B4gDbFzX2RLnAM9Bek5qIU8:nesNby26BmV9ugDxgnAMPRU8
- TLSH T1EC322A7168B8AC6B9EE3AE55B0473B139FB4507B97C52F98DAE94B0C05C719C2307827
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 6dfdffda7f6b3625f4a4c01a83b8ebcaa18be209d738be21cb8d6f7b1479c1b5
- MD5 c800851f168bd6f266f766c1690b6d83
- SHA1 20ca2be4e82205095715b5b861bfa7c02a6a2f2e
- SHA512 c391b3d7c1e09c698c008f4a6ade02473f885ea6aa0471b82c97e951bb0cfaae8ddf61644c58cbe5296fc478b1f67c7a0feddf1b7d9d71b6837640f6064b8327
- SSDEEP 192:ZONb6IT0JZQmiUyMlOgibFzX2RLTFudO/U6:ZONb6B3DOgixgM4/U6
- TLSH T13902D935A8ACAC6B8EA3AE49B0873B235FA4117FDA957F84D6E41B1C01D718C1703836
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 c51bde05ff496388d2eb2b97881e7d7870d2aa04cb04a964a5df4bc839a9c15d
- MD5 3123db1634efc67281bf1f83e6922b27
- SHA1 e032cd70367da4bd737cc84975746c77c3ac53b8
- SHA512 ee6c359861acce5414d3a8ccccfed97bee58d0b29ed8709e7d922c0d207f6d332cd5765701dd14d1cd1e4a27179d79a2ce0ede806280ad44ffdf1f207f0f7ea2
- SSDEEP 192:VRONe6IT01QmiUyAlogibFzX2RLnAM9Bh15qIU6:fONe6LJogixgnAMTRU6
- TLSH T154120871B8ACAC6B9FA3AD55B0877B135FA4617BD7C66F94DAE41A1C04C718C2307832
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 18KB
- SHA256 dcea0e08a782191f3dd37c1db19fda723b582c60aa3a04ac89e71f2f95cdc49a
- MD5 11a4a8a6a57fe98f83c92f2309455056
- SHA1 86ed28b253d27fe618b709780cf14820db0dadeb
- SHA512 796e69b73ec5f4b97f1c0e8a77fc35ca902333b3970770f3a8ff71beae443d994a73db75b40a1366fa8af8494aa96b7aa963c5de727bef4f9359bac28493fa39
- SSDEEP 384:nDjccCs+Bt0S3vsNbx26BmP9ugDxgnAMPRXU/AatId66lZr9f3d:vccQPv71OLPRXabW6cVd
- TLSH T1CC826B7168B86C3B9AA39E25B1473A036FB460BB97C52F68EED94F0D05C719C1307926
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c162ecba-b5e5-4c54-b1a2-34b5054bc665.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 1205ea32c5e9886d9e2ae6e5e31d7dc310df812c7a51d93695751d0fa10f026a
- MD5 db35a6aa12764d0df2c12a111b3e8719
- SHA1 a31f5b01ad90120c326679031c0ab12089b36453
- SHA512 b9223812f776a905441072a76fa4b80407349148d918f95355f8e7d3a98426bfa2a820427243c704009361f769db8eebefa1d2bacb3e6d439c6ad8e3b6b2e1ee
- TLSH T12B413D58B2FD1108B3B76E569BF6A96D487AB8772E06D5AE10100E4F0A26B41CC71733
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\80b335d5-1600-4669-845c-adbe146e2f88.tmp
- Size 10KB
- SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
- MD5 78e47dda17341bed7be45dccfd89ac87
- SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
- SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
- SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
- TLSH T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\eeda2f97-90c7-40b5-b606-19ec3eb8b477.tmp
- Size 1B
- SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
- MD5 5058f1af8388633f609cadb75a75dc9d
- SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
- SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4296_455236282\865e7399-7914-47b2-b14e-405a06afa8be.tmp
- Size 147KB
- SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
- MD5 9c670f04d98ab7404f16423f6ee6cdfa
- SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
- SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
- SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
- TLSH T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4296_589750666\CRX_INSTALL\content_new.js
- Size 10KB
- SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
- MD5 3de1e7d989c232fc1b58f4e32de15d64
- SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
- SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
- SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
- TLSH T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
- MD5 SHA1 SHA512 SSDEEP TLSH