Analysis
- user interaction
yes - max time kernel
148s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/06/2026, 18:24
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
- A potential corporate email address has been identified in the URL: [email protected]
- A potential corporate email address has been identified in the URL: [email protected]
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1676 msedge.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267126931251329" msedge.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{47C99642-DD5D-4C6C-AB0D-E56EA2CC6BF9} msedge.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3596 msedge.exe 3596 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 2872 wrote to memory of 2948 2872 msedge.exe 85 PID 2872 wrote to memory of 2212 2872 msedge.exe 86 PID 2872 wrote to memory of 1676 2872 msedge.exe 87 PID 2872 wrote to memory of 2212 2872 msedge.exe 86 PID 2872 wrote to memory of 2212 2872 msedge.exe 86 PID 2872 wrote to memory of 3880 2872 msedge.exe 88 PID 2872 wrote to memory of 3880 2872 msedge.exe 88 PID 2872 wrote to memory of 4744 2872 msedge.exe 89 PID 2872 wrote to memory of 916 2872 msedge.exe 90 PID 2872 wrote to memory of 4744 2872 msedge.exe 89 PID 2872 wrote to memory of 4744 2872 msedge.exe 89 PID 2872 wrote to memory of 916 2872 msedge.exe 90 PID 2872 wrote to memory of 916 2872 msedge.exe 90 PID 2872 wrote to memory of 1192 2872 msedge.exe 92 PID 2872 wrote to memory of 4088 2872 msedge.exe 93 PID 2872 wrote to memory of 1192 2872 msedge.exe 92 PID 2872 wrote to memory of 1192 2872 msedge.exe 92 PID 2872 wrote to memory of 4088 2872 msedge.exe 93 PID 2872 wrote to memory of 4088 2872 msedge.exe 93 PID 2872 wrote to memory of 4664 2872 msedge.exe 100 PID 2872 wrote to memory of 4664 2872 msedge.exe 100 PID 2872 wrote to memory of 4636 2872 msedge.exe 101 PID 2872 wrote to memory of 4636 2872 msedge.exe 101 PID 2872 wrote to memory of 1884 2872 msedge.exe 103 PID 2872 wrote to memory of 4176 2872 msedge.exe 104 PID 2872 wrote to memory of 4176 2872 msedge.exe 104 PID 2872 wrote to memory of 4176 2872 msedge.exe 104 PID 2872 wrote to memory of 984 2872 msedge.exe 107 PID 2872 wrote to memory of 2328 2872 msedge.exe 108 PID 2872 wrote to memory of 1400 2872 msedge.exe 109 PID 2872 wrote to memory of 2896 2872 msedge.exe 114 PID 2872 wrote to memory of 2896 2872 msedge.exe 114 PID 2872 wrote to memory of 2896 2872 msedge.exe 114 PID 2872 wrote to memory of 1164 2872 msedge.exe 117 PID 2872 wrote to memory of 1164 2872 msedge.exe 117 PID 2872 wrote to memory of 1164 2872 msedge.exe 117 PID 2872 wrote to memory of 1316 2872 msedge.exe 119 PID 2872 wrote to memory of 1316 2872 msedge.exe 119 PID 2872 wrote to memory of 3596 2872 msedge.exe 121
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://app.smartrequest.com1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffa051cc188,0x7ffa051cc194,0x7ffa051cc1a02⤵PID:2948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1852,i,6764084931388243385,10198938642527606138,262144 --field-trial-handle=2272,i,2999525521239426358,15771206432333460969,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:22⤵PID:2212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,7454210558834796496,12138147327935557678,524288 --field-trial-handle=2272,i,2999525521239426358,15771206432333460969,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:32⤵
- System Time Discovery
PID:1676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1384,i,5469134662790209035,12702318065546750101,524288 --field-trial-handle=2272,i,2999525521239426358,15771206432333460969,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:82⤵PID:3880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,814219902271280432,17823229013180728412,2097152 --field-trial-handle=2272,i,2999525521239426358,15771206432333460969,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:12⤵PID:4744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,15815044122940814170,1332855256907896120,2097152 --field-trial-handle=2272,i,2999525521239426358,15771206432333460969,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:12⤵PID:916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,4978995316677408345,15359435131074759261,2097152 --field-trial-handle=2272,i,2999525521239426358,15771206432333460969,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:12⤵PID:1192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,9779362155308309935,9871175861154841650,2097152 --field-trial-handle=2272,i,2999525521239426358,15771206432333460969,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:22⤵PID:4088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,933186531616510195,8775218634830712276,524288 --field-trial-handle=2272,i,2999525521239426358,15771206432333460969,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:82⤵PID:4664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,5593056507351743827,6931270025213971552,524288 --field-trial-handle=2272,i,2999525521239426358,15771206432333460969,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:82⤵PID:4636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,15713694003704490900,3712497635556118653,524288 --field-trial-handle=2272,i,2999525521239426358,15771206432333460969,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:82⤵PID:4760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,15713694003704490900,3712497635556118653,524288 --field-trial-handle=2272,i,2999525521239426358,15771206432333460969,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:82⤵PID:1884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6252,i,6889718120791077330,8330868716663905844,2097152 --field-trial-handle=2272,i,2999525521239426358,15771206432333460969,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:12⤵PID:4176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3432,i,10781650956949429662,16730596785610881656,524288 --field-trial-handle=2272,i,2999525521239426358,15771206432333460969,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:82⤵PID:984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,14017042781848363464,15613887588945926505,524288 --field-trial-handle=2272,i,2999525521239426358,15771206432333460969,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:82⤵PID:2328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,17785820906420287865,7140521515527996545,524288 --field-trial-handle=2272,i,2999525521239426358,15771206432333460969,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:82⤵PID:1400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5528,i,7266884426729014866,7719216958594656114,2097152 --field-trial-handle=2272,i,2999525521239426358,15771206432333460969,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:12⤵PID:2896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3504,i,145121276748960761,4442485137892055334,2097152 --field-trial-handle=2272,i,2999525521239426358,15771206432333460969,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:12⤵PID:1164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,7096100028184744566,3608348996651866773,524288 --field-trial-handle=2272,i,2999525521239426358,15771206432333460969,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:82⤵PID:1316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5976,i,4600735277171701670,6986250175390078793,262144 --field-trial-handle=2272,i,2999525521239426358,15771206432333460969,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:1212
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
- Size 105KB
- SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
- MD5 f5ed4946834be586ac6410ed88740a7c
- SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
- SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
- SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
- TLSH T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
- MD5 7ab616f55807e9de5195a40c50f65e5b
- SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
- SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
- TLSH T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
- MD5 504ce80b644a85a7e68d85bd24169289
- SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
- SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
- TLSH T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 9c9b6375dd32fbc9958294ce5d14d5e5b49c016aaa31303a9c5c4ff1552f4602
- MD5 7e42c12690ca5cae4677ace8c2e1625a
- SHA1 c98f47b1251860b8bd471ad01bf715ab6a52ca6f
- SHA512 5a9ee3e80461a1843a1f702e4f062ddaf931ed501bfb59ff35957c2f5fda8489cc965080a878824a02519f9c736b4601c756268929c820dfc3074ab881803be2
- TLSH T141812832217600E7FF3142323DC11225BA7DACEEF6AFEF2A4820D4731C66321D1A8684
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 680fd7ceee28474faaa58f49356d97c286a5132c6e241e4f009c52cf4bfb7b18
- MD5 133e9d50e721c9c51581a32b0ad129ce
- SHA1 81208a254460f44d97e027bbc7021da0a14a5209
- SHA512 e79bb13c384219d535bc00bf92bd07bd0c9a1f08aff18dd4f32a95e52d12f55408d76cd3cf8107ca9c6c805776efc9cb8f5bacd4187e846b3093481ea04049b0
- TLSH T18A811836217A40E7FF3242723DC11225BA7DACEEF6AFEF2A4860D4731D66311D1A8644
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588a88.TMP
- Size 3KB
- SHA256 435b87564aeffa65a1b584785fb90c63378c53cedc90dd382763e2ea78d39be0
- MD5 9937e97de16a74a03db1192f7fcfd8dd
- SHA1 882936e13d2e4100985292e6bb5818116bb2402c
- SHA512 92e235cb793b63b3072e9b7edc981e0cd84ac65b023571aecf46f9e6bcbca61c25477279f794819b235ccbe0a5d0c28a2157e0e895c2b76bb6492c75a37c4fa9
- TLSH T15371C336222140E3FF31417239C16201F97DBCEEF6AFEF2A4964D4B71C69712D1A9918
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 f4ceba9210a5240135d1ab64734fb356de034762e6587c2f94042633f79b7d9f
- MD5 d31397d85c94f06f8f6911ed7515c2d1
- SHA1 214a1bf5f5983b7696283d035e41e9bbd80a6553
- SHA512 9586415cfae92fdc827944260b61811d66876e461f81e746be0cf3e7c69e37fa411beab928c9c71f2fd422e1a4491d8708f9f04a50a7735dd48e573a97a294d3
- TLSH T1FE719BF747F099BDDE0155F17A147D1BCEAC0A24032C789A8AD4BE0A93F2871E24065F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 12KB
- SHA256 d028a057c9aa5e1d61717172eacb35df2b96f078986b8773a028b571d14cf390
- MD5 eccd155e94b0bcb5cd391e9494d38c57
- SHA1 6165ed830fc69d6a98e45030db56d27491e768a8
- SHA512 e55c65e779213ce666f76be33112ebe89e709b2ef8d1770d915e4cf5c09a907e1d6e0cd7435c1d1bbeab1a9f7d3f0dcdc9d8cfdbc2e80f7a09819ca29c1c4c5e
- SSDEEP 192:sxZhRjyM/jK1Ml8Mk+/fwsKsL5IdpClHW6+WNCP//YInh31IgrJ:sxZhlM+/fws5LSSHb2/N9
- TLSH T19552FA126A38997BCCDBD209FA55BF53D6F51572A2910D48A9FCCA1C04F6AEC2207C1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 f8e1b6c77eac461e5d864eb5389fdfbbaaeb981b02e6aaf938e855d6739e677e
- MD5 2639345a14b7a686bacea8c2c2902d26
- SHA1 33c6783e57b37b41b83a678e3353f8eb7e3b6298
- SHA512 e3fe426020bf593dda2b16b82ba5f695e7b9b7ad5088b4533a1120d2e1a7592e5209217b205b7f080de33b9daf443524aa6b6ff1afb272c2ce7795cd96b04d00
- SSDEEP 192:sxZRRjyMojK1Ml8Mk+/fwsssLiIdpU2mnlHW6+WNlExmgnA77ZJYIo4u1Ig5DJ:sxZRIM+/fwsLLLeHbwFAJJub
- TLSH T11D62E712A638597BCCDBD209F945BB53D2F51572A2901E48BAFCDA1C04E6BED2207C1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 db8a1c004b0c05eba6751a8941ac4c72509d780427b4b3f2d18bc3bc45479b41
- MD5 81d73086046118daa6799bbf647a80d0
- SHA1 c2d8fcf3fa5c6b37c5d618bab7a4eadf65984f25
- SHA512 3e89c7824075c0f1e95c673122204866c6476dded7a8a0130e5a7fb8db014eedc73b1584ddf6cf66497b2c38c02560b7f5034a240a841f9ebc631da4667f80e3
- SSDEEP 192:sxZRRjyMojK1Ml8UQdk+/fwsssLiIdpU2mnlHW6+WNlExmgnA77ZJYIo4u1Ig5DJ:sxZRIq2+/fwsLLLeHbwFAJJub
- TLSH T17B62E752A6385977CCDBD209F985BB53D2F51572A2901E48BAFCCA1C00E6BED2207C1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 a28e3380c13fedeb021834abccae0c87959cb77dfe18c124dbe424bacae42325
- MD5 bd82326723f544e776c088030aeb22db
- SHA1 ccede4567e0cf44f0bf645f0bfaa8e8b3d9a9de2
- SHA512 d7e989500ad0f121473c3afddec0bcb4d166a9d366912e75e8c9d275763fd12ebf0f965d02caafed40a484305e98676bceebf627a751acd9681e194885c25187
- SSDEEP 192:sxZhRjyMojK1Ml8Mk+/fwsssL5IdpClHW6+WNCgnZYIsP31Ig5DJ:sxZhIM+/fwsLLSSHbpZ+b
- TLSH T1FA52F9126A38597BCCDBD209F945BF53D6F51573A2900E48AAFCDA1C00E6AED2217C1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 30KB
- SHA256 ccf3a6f027cf6d3c0341d333de7d076f0e17dffb091c1918742e0747d945e13e
- MD5 e4ddd3073f525ab79e4bc098079e08d8
- SHA1 1189fca820cc7691ea0d9ee7603cb333275093a1
- SHA512 3a142a89996c5a2f5229eb7a01f91b591e5c42eefcc932235af0556cf30fdd18afe6593a94b504403faf6421d3751f53930066dc511a979ca0cdd7f52352df9d
- SSDEEP 768:X7sqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9wrofEL:X7sqxXlWvJD6Tu1ja54LAs9bfO
- TLSH T1C2D20B3B694CCB7D4F840E6DEC266ED76ED801CBA6988D5447FA880C03CB7EA11165DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 6KB
- SHA256 a91fe752e1dc465086310632d72e99ee24bc5aa800f2a65679d6235dc6db3ab6
- MD5 326a63a57dd4e34840d0ef9001bcadd9
- SHA1 532ed032e3d8df14d4134d0525258f40767d2a67
- SHA512 09d2a4a4a0c801aa79acaa04c25f45cdf5aba89cb1108cba33fe69c75c924379a396a29dd4576e53d4bd7619ca228e0be4befcf8346e39c51cb5b48a987bf295
- SSDEEP 96:KYbaKYIKmXGKwg2uzCnTRZZezpoFhzeKZrhFe9bzg16yBmSgYI2qYX9IS2KwTIU9:ExN9uzCnTRZZEpojzzrhFYbzg18ldf
- TLSH T1FEE16B2236770202387E2908E3AEC5779E5376633419E46F3B7850A64DA7E216DFC8DD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eed42e81-bf42-467e-9ed8-e49b064f0e8c.tmp
- Size 106KB
- SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
- MD5 25dca813dd764f2197142ef84bc5ce66
- SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
- SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
- SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
- TLSH T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5910ee.TMP
- Size 3KB
- SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
- MD5 904e6e94a1d46374c8630cfd86cc729f
- SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
- SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
- TLSH T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 19KB
- SHA256 ae86214e0aa187a116d850393ffe6e99bba75107fd57371ae869b718c718f1e0
- MD5 ca673d8c7d53c6cead9f065c52537c26
- SHA1 f57146d2c26f84467f17abe9c465b39207475b80
- SHA512 f8ab85635c80cb5a6a12b30e98009f042daef150d6526ed90dcc2d7419a9cdd50c339c237791aa75b03c344ae20eaa0c5ddaebd43014dce6e90cb6bde8580342
- SSDEEP 384:EtNn/s3n9SfsNffh9KPKbZgwVRNNOE+l9R+2fV/Pb9oR3W2Ox9X:Ej+9U2QGHNOEI9RlfV/AKvX
- TLSH T102927C3259399C361EE25A44F04B36071FB85077A6C63F99E1E96F0D02DFAEC134AE16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 27KB
- SHA256 94d6a39d43f4bbb7abc8315758a1f6c90fab4e0bb86a3443b41927271038efc9
- MD5 9fce4e33df6af7de0e3fa862f693ba3d
- SHA1 3b1f18f21df6c05f43b6c3b31d6e6dbb72f309e3
- SHA512 d55343e5b2affd9424631ffe9f4229c4f7537959b4e48e4a947bb81837466a8d2710fd001451648541073145edaa7dd071a8d5b1647fac6e86ce9cd20387b8f3
- SSDEEP 384:yiF1tNn/s3n9SlzsNB8TUNTUlIl1h9KPKbZVwVRNNOE+l9R+24V/Pb9oR3W2Ox9X:5F1j+9+gwg9FGHNOEI9Rl4V/AKvX
- TLSH T121C22AF245DB8C36D9AE0B47A37E2E034EBCC067B5816A54B3995A0CCD8A5BFC346D01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 19KB
- SHA256 abf8e555f3b1d8bcf082ee8c8c9bd9bf6f74f86e767ce5196b5fd8efef77bdb7
- MD5 12c699da76cb1c22b9194cb0b5c94c2a
- SHA1 8f65434010a812abbfb2e53a923ad81b6ef91196
- SHA512 ad6ee7c91d402adde92afcbdb80ae05b9043f8cbbded31aa59a5fcd0373434d1484129f29545e29c9f5a416b9b8f4a9bd5327f4cda3ac076d45d51839f3e32c3
- SSDEEP 384:8tNn/s3n9SfsNf1h9KPKbZgwVRNNOE+l9R+2fV/Pb9oR3W2Ox9X:8j+9UIQGHNOEI9RlfV/AKvX
- TLSH T168926C3269398C361EE25A44F04B36071FB8507BA6C63F98E1E96F0D01DEADC134AE16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 cdf1fab8c67ac7b86323fadb551a08838beb0270070186d20286dd6b383cf0d6
- MD5 f49f369e1f79b836abfc86e095a35097
- SHA1 45623afbddc0448c3a58c3ffc3332a8a90c1b4dc
- SHA512 1a6cc85244f677b393d5e5bc93aa0a3b64e3b23613547a500e343e7af314d386ce88032bf71fb1db7eda8dbc229a9986ff680ded0a5dc6f1c1ff7abee5ac9bfe
- SSDEEP 192:tON16JkRtQmiUyxXW+RNNOmz+ih32RIU6:tON16UrWW+RNNOE+6dU6
- TLSH T14102E9356D382C7B9EF26E05B58B27175FA8203BBA856F80D6D81F1C01D765C2346836
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 da194d8ebee86b438a1e49e205dbac282938c355e7bcb14543eeb952c3f2572b
- MD5 0ae35c446e00db460901cca8932f8764
- SHA1 54a2d05abaae27c0d9694783fe1d41f1c891ddff
- SHA512 dc09e98b1bbb545344c25d8248766efd24998c814d9f0538cc349d556d4abaacc23cce96ba42e8a1f23956fc634baa3f61df310c16dd4ad224f0ce573ba1b772
- SSDEEP 192:AONi6JkRRQmiUyaXw+RNNOmz+7R9R+21VcSqECU6:AONi6Uv3w+RNNOE+l9R+2YVU6
- TLSH T1FC120A326C285C775EE26945F48B31174FA91127EB8A6F90D1DC1F1D02EF9AC234EC26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9d4988be-b70f-44b3-8a62-5b69348e59ac.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 44cf241667b8001b515d611ce3fdca0c30d3e3de43033651df6f02bd7df7c017
- MD5 4c23546540fe74990af13c905028f9a1
- SHA1 5e47d0a0df05cdf0315fc1a7713b8d3b0d3a8cbb
- SHA512 35be931e40d07ace72cccc2f8eceb36cf85999de88f7abeed396f7767618a55e634c6d55bff6a74c1c6ef65aa35ec056d15acabd0ee8bd5b79eafd29000bc6a8
- TLSH T13241F488BBEE1158B3B36F5AABF6646D447ABC772E4BD45D00110D4E0623A80C871B37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512