Analysis
- max time kernel
148s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/07/2026, 12:19
Static task
static1
Behavioral task
behavioral1
Sample
index.html
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
index.html
Resource
win11ltsc2024-20260629-en
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
loader.html
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral4
Sample
loader.html
Resource
win11ltsc2024-20260629-en
11 signatures
150 seconds
Behavioral task
behavioral5
Sample
otp.html
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral6
Sample
otp.html
Resource
win11ltsc2024-20260630-en
11 signatures
150 seconds
General
- Target otp.html
- Size 9KB
- Sample260706-pg6dmaaz5m
- SHA256 8ea0d15cef79f60075b8dfdfd171ac32ec1550c77cfff9f764349b3688231e02
- MD5 d8c4904d11e75e33daef0693624a953e
- SHA1 8f1724ae3667746676bea72464461628a5e0f367
- SHA512 08577243e564fd8c3667962d721754ba79a1280709ee109b65c5bdd2e17947aec81d7c5e23fca58f2db9304b2e91c97ebea3bb019fb8b4ece5244c82e7360126
- SSDEEP 192:J8UjZpZpXQg3XJaWfDbzpp/bugYv31Plj:J3TJl631J
- TLSH T19212C005B9C411575B73D368AB71871CD9B34193DB05AD99399C1B87CFFAA008823EED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4916 msedge.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278139500682838" msedge.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{832E375B-6287-42AA-8E13-C3FC6ADAE0CC} msedge.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2364 msedge.exe 2364 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe - Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2024 wrote to memory of 4652 2024 msedge.exe 86 PID 2024 wrote to memory of 4916 2024 msedge.exe 87 PID 2024 wrote to memory of 4396 2024 msedge.exe 88 PID 2024 wrote to memory of 4396 2024 msedge.exe 88 PID 2024 wrote to memory of 4396 2024 msedge.exe 88 PID 2024 wrote to memory of 3980 2024 msedge.exe 89 PID 2024 wrote to memory of 3980 2024 msedge.exe 89 PID 2024 wrote to memory of 2400 2024 msedge.exe 91 PID 2024 wrote to memory of 1620 2024 msedge.exe 92 PID 2024 wrote to memory of 2400 2024 msedge.exe 91 PID 2024 wrote to memory of 2400 2024 msedge.exe 91 PID 2024 wrote to memory of 1620 2024 msedge.exe 92 PID 2024 wrote to memory of 1620 2024 msedge.exe 92 PID 2024 wrote to memory of 5072 2024 msedge.exe 93 PID 2024 wrote to memory of 2884 2024 msedge.exe 94 PID 2024 wrote to memory of 5072 2024 msedge.exe 93 PID 2024 wrote to memory of 5072 2024 msedge.exe 93 PID 2024 wrote to memory of 2884 2024 msedge.exe 94 PID 2024 wrote to memory of 2884 2024 msedge.exe 94 PID 2024 wrote to memory of 3312 2024 msedge.exe 98 PID 2024 wrote to memory of 2888 2024 msedge.exe 99 PID 2024 wrote to memory of 3312 2024 msedge.exe 98 PID 2024 wrote to memory of 2888 2024 msedge.exe 99 PID 2024 wrote to memory of 4284 2024 msedge.exe 101 PID 2024 wrote to memory of 3784 2024 msedge.exe 106 PID 2024 wrote to memory of 5008 2024 msedge.exe 107 PID 2024 wrote to memory of 4980 2024 msedge.exe 108 PID 2024 wrote to memory of 4228 2024 msedge.exe 116 PID 2024 wrote to memory of 4228 2024 msedge.exe 116 PID 2024 wrote to memory of 2364 2024 msedge.exe 120
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\otp.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x274,0x7ffc1b7ec188,0x7ffc1b7ec194,0x7ffc1b7ec1a02⤵PID:4652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,4213176662826142588,7567864131798576087,524288 --field-trial-handle=2224,i,17234935159870908947,7508848651659788381,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:32⤵
- System Time Discovery
PID:4916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,6859466887267849447,3954141108439813556,262144 --field-trial-handle=2224,i,17234935159870908947,7508848651659788381,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:22⤵PID:4396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,6226706093701321359,15808576928955946619,524288 --field-trial-handle=2224,i,17234935159870908947,7508848651659788381,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:82⤵PID:3980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,4580367083677341957,4060516924401775217,2097152 --field-trial-handle=2224,i,17234935159870908947,7508848651659788381,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:12⤵PID:2400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,12824420175101641039,11072214737359663816,2097152 --field-trial-handle=2224,i,17234935159870908947,7508848651659788381,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:12⤵PID:1620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,13019411014071945251,4131328527735585169,2097152 --field-trial-handle=2224,i,17234935159870908947,7508848651659788381,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:12⤵PID:5072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,13695905144876384971,8027212573570270528,2097152 --field-trial-handle=2224,i,17234935159870908947,7508848651659788381,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:22⤵PID:2884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,13664303694186513150,10885507241881972016,524288 --field-trial-handle=2224,i,17234935159870908947,7508848651659788381,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:82⤵PID:3312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,5620766376904242308,18322348668003126947,524288 --field-trial-handle=2224,i,17234935159870908947,7508848651659788381,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:82⤵PID:2888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,8864633273021983750,9458534718128583474,524288 --field-trial-handle=2224,i,17234935159870908947,7508848651659788381,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:82⤵PID:4980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,8864633273021983750,9458534718128583474,524288 --field-trial-handle=2224,i,17234935159870908947,7508848651659788381,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:82⤵PID:4284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,10173121674185463344,10800335017822598959,524288 --field-trial-handle=2224,i,17234935159870908947,7508848651659788381,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:82⤵PID:3784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,6927393575892478170,7819674935856859830,524288 --field-trial-handle=2224,i,17234935159870908947,7508848651659788381,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:82⤵PID:5008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,16752023095531017794,2587204202519542511,524288 --field-trial-handle=2224,i,17234935159870908947,7508848651659788381,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:82⤵PID:4980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,13376033643424168116,16460194820595232300,524288 --field-trial-handle=2224,i,17234935159870908947,7508848651659788381,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:82⤵PID:4228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5396,i,16743615682998517947,15037040656687627211,262144 --field-trial-handle=2224,i,17234935159870908947,7508848651659788381,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:2952
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
- Size 105KB
- SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
- MD5 f5ed4946834be586ac6410ed88740a7c
- SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
- SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
- SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
- TLSH T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
- MD5 1656a3560c7aeae221756f3891b89fd3
- SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
- SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
- TLSH T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\34403576-880a-4aa3-b4f0-cfbd0697245d.tmp
- Size 106KB
- SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
- MD5 25dca813dd764f2197142ef84bc5ce66
- SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
- SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
- SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
- TLSH T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 4bdbe3282eadca5365796401c41a97f1182ff56169459d4db05d6a360f04d9c6
- MD5 0e1098c508fff6fdd58c0af142de050c
- SHA1 3e6989646949c8aaf67fcd4bd37c8e36351d7c95
- SHA512 30cb6c6be3aa4c7833da2be38287a053634fd3ee540e270adfe60bb88e92a0d32d136132f516984ce0d85d6a78182296c0f1fffd279c7610e249611168b193da
- TLSH T1256162F8D44207E0EF5270B283DB462F76F082F8F913BE4190E42B796B0676186CB158
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 08827a6f716c6baa834db738d14bb47fc1bc65e40591d88049a6300275420f81
- MD5 6831b2e963469347e26ff6a36d7b2f5f
- SHA1 f9c5ddede9b24958d3ec0310591667d6e5ed1fcc
- SHA512 4c60c63685ed6db5c4030af02e752b9dc923c2d61ab6a9ecb031f7ccb9382aefd5216629d821f6a412724d3812bd84ec2d429eb36ecec61864b56c51d9921a90
- TLSH T1C9115CF783E5866E990156F0AA24AE2BCE2D0516432C7C1589E4FF6BD3F3475E00295F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 12KB
- SHA256 5be8638ec8e27f68cba3b46976ba11f0fb69869b18096d00686ec71e4e8e5dde
- MD5 4cbdc38b4c3bf351a9b7b917d8cbc209
- SHA1 5d9bd4a5d3ccfbb1d67274848640071a17a14fcc
- SHA512 010dc00f46dafdebb9f69446fe6dd084f389327a274d82e6b32788e7cc28586a17ea37973fcc6f537e1108b56e36d14edab281f903b3ae778cf9bb5dbd524ab6
- SSDEEP 192:sxZ2RryM/jK1Ml8Mkh/fpsEMeWcIdpdbHW6+WNGYzQTEOIgrJ:sxZ2FMh/fpsEJotHbGn9
- TLSH T11142D7126B34997BCCCBD209BA45BB53D6F51472D2940D44AAFCCA1C05E7BED220782F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 6fecc036d54fa4294edb930b599d412ad26c57125473f3243002a25abbb0adb6
- MD5 0dbe89e1fe63ce80c85f99041fb0f5fa
- SHA1 d1b75df5ed1ff8af63a25ea9c427d91415d5a02d
- SHA512 4015add0306370e9da265efa42ee2f459b7715bf2342937e9ed79addb50936e56a2898c773e01fdd974e05ab51f84075ba1f98f7c65db8f0c6f88674e32273c7
- SSDEEP 192:sxZ2RryM/jK1Ml8UQpkh/fpsnMXWcIdpHbHW6+WNGYzACKOIg5MJ:sxZ2Fqqh/fpsnAo7HbGge
- TLSH T11852E6126A349977CCDBD209BA41BB93D6F51473D2940E44AAFCCA1C01E7BED220782F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 30KB
- SHA256 cd9d386da7f17c8b2cc1a7ab0db4959e27fb2e58f76411165af8b5e4ea96c4f2
- MD5 de40297df5ea433b437e3a67f01be2a9
- SHA1 2bdbb0a9a778cb8a5c52831ad5bcfd3ebf1af25b
- SHA512 a39c9760f5840d4e7b992f0c80cf4050144c1d9d041658ed0bd180cfd056d8d0fefebb3f79c2d637bbeafe2560eb7cd7a74475908979406a46ee6f7ef64d53ab
- SSDEEP 768:7aW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjkroI4iSYHF:7aW7kf0Wvqidau1jaa5LA3jvol
- TLSH T1CDD2FB3B680CCB7E4F841E5CEC266F966ED801CB66988D5487FA884C03CB6EA51175DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 5KB
- SHA256 d65ef56377f30646e025f88d924eac9d694477081f6e5906e50835d18ff15ca3
- MD5 1e408f1ca1e15af6dba5757f26b891d2
- SHA1 8acb151474abec7434c8a48b455191e3925fdce0
- SHA512 8c028b93f1cc468e7f24d9c09589ac6f9f3df96d4db6740e8afc3e4dce196b7f2afbab28bec796e759f48d7af2e4a000d7063e7c473cb8f707bd35ddd423b3d7
- SSDEEP 96:KIbCKcXj+KM42CkIKRSCOrWKkIor0xFz+:sqlnPtbr0xFz+
- TLSH T173B1546632370606387E2D6CA65E89779E4236633458A46F3BF801A51E27E121FFCCDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592ca4.TMP
- Size 3KB
- SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
- MD5 904e6e94a1d46374c8630cfd86cc729f
- SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
- SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
- TLSH T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 19KB
- SHA256 e47baf9dea66746572eaba1316cc5790931d83869e2c8467e43228d82e4254d4
- MD5 dd905cf6cccb3eeb02df1c22d10a003a
- SHA1 61b0afdb4bfcec0b08765862243b711ddc9c521a
- SHA512 c150f21dec89883d049be6f6bf8fa1168dd0ee8f7acf94f081828b691af82a29276ba9c7965f898ce24727ab3e8cfb418afcc07cbf10f56559b8aedc892a633d
- SSDEEP 384:mtNn/s3n9SfsNDuDNfL3b64nCDdmmaHCEJrCaOObjI9G6w7xDU:mj+9UjbXncIhhCa29M+
- TLSH T132928D325C254D738DA29155F5873A1B9FF4817BA7C52F88E6ECAF0C02EB6AC4311806
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 c2a549a1575803f10233676cb6a9c517a026b0eaf0e78d11f39553d1ae3de3f9
- MD5 f6b7fe241d676e658e027008d122d3a5
- SHA1 7bc7e1518db4911179ed61d5eeb61fe2a915b5ca
- SHA512 10fe8e69ad6865da4ccd48a0e7cc770b33d696e0d925f0cd28010dc13441baf98a17763d5bbb2be845b24d08dab253b5b8e0104e701d5e190ce32dcb1928fb62
- SSDEEP 192:MONK64BAQmiUyR1IW5GBPK7H+FdGBma2EaDQ+U6:MONK6eAyiWIdmmaOrU6
- TLSH T17802F935AC786C7B9EB2BE45F58637175FE8103BE6945B44EAE81B1C00E734C234282B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 22KB
- SHA256 2880b62faf251c58a548336b52de6a3219bcdf57bf4df80408048ed36a13f297
- MD5 4f8c9383a4a438ac7356e5f38e40f6b1
- SHA1 20bf850c05049edbb1601187513dd5b85cbf1d5a
- SHA512 439f18445bb0cbf345c42f344ec5ff2f0692994363e4fddedaa19583ea4b5f58a56ed40acd1265229587054a5da7e6d08c56d49884d561e6f7b29229d6c705c9
- SSDEEP 384:riF1tNn/s3n9SfzsNd8TUNTUlIl/DNfL3b64nCDdmmaHCEJrjaOObjI9G6w7xDU:GF1j+9UswgHbXncIhhja29M+
- TLSH T1FFA27C335C648E7B9DA29A55F64A36179FF441BBD6C56A84F7DCAF0C02EB2EC4302805
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 66cca5ab4018bbe36e4474f615ad042f56c396535db573fbf104d3ffd3209898
- MD5 344c0a3c3e62e1ac11759addb29f8fdc
- SHA1 1277f9232ebb2581761a516fe77b9ed3beae6c33
- SHA512 8019f1d7b4a9de77bce70e35f462f13342993bcb427606e7b6131ef2e9f0b423066c876b09a3ed4c729a680cb86925b789dd9576858603c8b8a28c45f2cb0e11
- SSDEEP 192:iONW64BJQmiUy0yIe5GBPK7H+FdGBma2dEFC1SJrAWwTqVU6:iONW6enLFeIdmmaHCEJrmaU6
- TLSH T1E5121B36A8745C6B9DA2B541F48736135EE4413BFB856F84F6EC7B1C02EF6AC2306816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 19KB
- SHA256 dc2bf369e04006ad69b24f38ebd175de473c7bbb238665f75ad50db2bfdbd408
- MD5 9831651774b66fde125cf393513ca3a1
- SHA1 352133e95cbcba2dc09fc80621cc5b1b8b9125ae
- SHA512 7790502e5322c011ff3dfe8a61f81c4a95fbe7946a0ef01baa6c7976ebc8e65fab945d29c3087fb42ad796be70e06c3aa5ff76265f20cab45cb7c86f83965c27
- SSDEEP 384:FtNn/s3n9SfsND/DNfL3b64nCDdmmaHCEJrCaOObjI9G6w7xDU:Fj+9UybXncIhhCa29M+
- TLSH T1F6928E325C254D778DA2A155F5873A1B9FF4817BA7C92F88E6ECAF0D02EB6AC4311406
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c91d7f1b-a7e0-4e8e-942c-eeb32203c69b.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 5901cdb912d57d4381157e7dda94e5bcbaacc7c75389789eedb64e92be97bbab
- MD5 64da89359a1f5246e79653fbde680636
- SHA1 efbd9e867a3c941ebe020bcaa6f701367e30dde4
- SHA512 bbeb1a696f860bb79860bfa7fe41ed84351603b3a726f72c0d7e90e7b14eaac569ddc127259e2f7156b60d66b7469dc378d040b1a568bab60bf3d5db8d0daaa6
- TLSH T1A2413B68A6F91148B3776E5AABF6A86E487BBD372F0AD05D10100E4F0622B40CDA1733
- MD5 SHA1 SHA512 TLSH