Analysis
- user interaction
yes - max time kernel
149s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/07/2026, 01:47
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://t.co/6d8OyJyh00
Resource
win10v2004-20260513-en
10 signatures
150 seconds
General
- Target https://t.co/6d8OyJyh00
- Sample260712-b7htcsby4p
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4848 msedge.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134282944425712453" msedge.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{DA27A961-4E01-4536-AEC6-6BBFBEA666F3} msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe - Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe 3624 msedge.exe - Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 3624 wrote to memory of 4952 3624 msedge.exe 86 PID 3624 wrote to memory of 4848 3624 msedge.exe 87 PID 3624 wrote to memory of 1508 3624 msedge.exe 88 PID 3624 wrote to memory of 1508 3624 msedge.exe 88 PID 3624 wrote to memory of 1508 3624 msedge.exe 88 PID 3624 wrote to memory of 2232 3624 msedge.exe 89 PID 3624 wrote to memory of 2232 3624 msedge.exe 89 PID 3624 wrote to memory of 2040 3624 msedge.exe 90 PID 3624 wrote to memory of 2040 3624 msedge.exe 90 PID 3624 wrote to memory of 2040 3624 msedge.exe 90 PID 3624 wrote to memory of 4928 3624 msedge.exe 91 PID 3624 wrote to memory of 4928 3624 msedge.exe 91 PID 3624 wrote to memory of 4928 3624 msedge.exe 91 PID 3624 wrote to memory of 5096 3624 msedge.exe 93 PID 3624 wrote to memory of 760 3624 msedge.exe 94 PID 3624 wrote to memory of 5096 3624 msedge.exe 93 PID 3624 wrote to memory of 5096 3624 msedge.exe 93 PID 3624 wrote to memory of 760 3624 msedge.exe 94 PID 3624 wrote to memory of 760 3624 msedge.exe 94 PID 3624 wrote to memory of 2380 3624 msedge.exe 97 PID 3624 wrote to memory of 2380 3624 msedge.exe 97 PID 3624 wrote to memory of 2380 3624 msedge.exe 97 PID 3624 wrote to memory of 5088 3624 msedge.exe 98 PID 3624 wrote to memory of 5088 3624 msedge.exe 98 PID 3624 wrote to memory of 5088 3624 msedge.exe 98 PID 3624 wrote to memory of 2140 3624 msedge.exe 100 PID 3624 wrote to memory of 2140 3624 msedge.exe 100 PID 3624 wrote to memory of 548 3624 msedge.exe 101 PID 3624 wrote to memory of 548 3624 msedge.exe 101 PID 3624 wrote to memory of 1544 3624 msedge.exe 103 PID 3624 wrote to memory of 3968 3624 msedge.exe 117 PID 3624 wrote to memory of 1948 3624 msedge.exe 118 PID 3624 wrote to memory of 2268 3624 msedge.exe 119 PID 3624 wrote to memory of 3040 3624 msedge.exe 121 PID 3624 wrote to memory of 3040 3624 msedge.exe 121 PID 3624 wrote to memory of 1180 3624 msedge.exe 122 PID 3624 wrote to memory of 1180 3624 msedge.exe 122 PID 3624 wrote to memory of 1180 3624 msedge.exe 122 PID 3624 wrote to memory of 3212 3624 msedge.exe 123 PID 3624 wrote to memory of 3212 3624 msedge.exe 123
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://t.co/6d8OyJyh001⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffaa95ac188,0x7ffaa95ac194,0x7ffaa95ac1a02⤵PID:4952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,8908568316880497339,5144242421088832757,524288 --field-trial-handle=2232,i,10419400217443677897,1722826867638078303,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:32⤵
- System Time Discovery
PID:4848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,1571953785592315713,4504852556376748957,262144 --field-trial-handle=2232,i,10419400217443677897,1722826867638078303,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:22⤵PID:1508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,373878593738339846,424745981857629264,524288 --field-trial-handle=2232,i,10419400217443677897,1722826867638078303,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:82⤵PID:2232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,5167274703422099694,14970825451254820582,2097152 --field-trial-handle=2232,i,10419400217443677897,1722826867638078303,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:12⤵PID:2040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,17940524791523373866,15552193445076880077,2097152 --field-trial-handle=2232,i,10419400217443677897,1722826867638078303,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:12⤵PID:4928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,9257225348444365450,823057220853470084,2097152 --field-trial-handle=2232,i,10419400217443677897,1722826867638078303,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:12⤵PID:5096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,14396636277389171218,4542247794327541672,2097152 --field-trial-handle=2232,i,10419400217443677897,1722826867638078303,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:22⤵PID:760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3528,i,17452800956046047354,6036315571772732501,2097152 --field-trial-handle=2232,i,10419400217443677897,1722826867638078303,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:12⤵PID:2380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5264,i,6390393298251151879,9316525144818529330,2097152 --field-trial-handle=2232,i,10419400217443677897,1722826867638078303,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:12⤵PID:5088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,4089655528056092956,4512004215765907178,524288 --field-trial-handle=2232,i,10419400217443677897,1722826867638078303,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:82⤵PID:2140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,3873427831633362260,8830539187724918097,524288 --field-trial-handle=2232,i,10419400217443677897,1722826867638078303,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:82⤵PID:548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,14112296888438972738,6421400360429451667,524288 --field-trial-handle=2232,i,10419400217443677897,1722826867638078303,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:82⤵PID:3044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,14112296888438972738,6421400360429451667,524288 --field-trial-handle=2232,i,10419400217443677897,1722826867638078303,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:82⤵PID:1544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,7229338588883366773,10028247950693186255,524288 --field-trial-handle=2232,i,10419400217443677897,1722826867638078303,262144 --variations-seed-version --mojo-platform-channel-handle=140 /prefetch:82⤵PID:3968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,4640043658787055046,6656636748220750106,524288 --field-trial-handle=2232,i,10419400217443677897,1722826867638078303,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:82⤵PID:1948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,3966789194455757862,16545956632846985234,524288 --field-trial-handle=2232,i,10419400217443677897,1722826867638078303,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:82⤵PID:2268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,6837061426640195853,16339444103442880095,524288 --field-trial-handle=2232,i,10419400217443677897,1722826867638078303,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:82⤵PID:3040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6204,i,621047614281892187,4629591720544872544,2097152 --field-trial-handle=2232,i,10419400217443677897,1722826867638078303,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:12⤵PID:1180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,11775788851671827471,11535808377487196277,524288 --field-trial-handle=2232,i,10419400217443677897,1722826867638078303,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:82⤵PID:3212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:4556
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
- MD5 1656a3560c7aeae221756f3891b89fd3
- SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
- SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
- TLSH T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 8b98c8b6b381e81c2bbf54b9caa68f2c18c9e88f35c3a0ec4606ce6913bec6fb
- MD5 63bf6d0df9b19fddac83abae873ac109
- SHA1 5dd25151b771fd9586d645e48a09c3c90206c6bb
- SHA512 e66a1dca651cf59894f7ab0cd8a741d4d6514106675ff2869a2da724d152ec5ba25cd4d2730c51475df230cad415588165a556047cfbef5d2717e3e00337d474
- TLSH T11ED0A720773978C2D2291071E4224B4076AD54B6215A82466254840D5C7A4C696CB682
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
- MD5 a8d0099e5966b86c13c6997282a63770
- SHA1 df541b93a0caebe364906ec90c768bb625495f4c
- SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
- TLSH T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 d034bdf60feaba9eb44c036b2ec01a5d3c92ee9d9917b1208c27680c2705d181
- MD5 9249333bb645854b709538b52440c31f
- SHA1 5a38fc5d6f715eb75bc6409ca6552fba27ec4290
- SHA512 c823f1de84effa2b9c7c8a94da7da2e0f498fcbf330b494dbded7ed8231618c8393469b0ab739dd660b6377bf4065d08753695285cdbb19f5a35f45c413559e1
- TLSH T1AA618238C78349A5D76174B290FD0F24797587D8FAF32D85D86829346F1B751C3682D8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 83016a6b7a9da2343449b1df0081b3f9b1ecc7ec8151496376e3d2f3659a553e
- MD5 a8365226df31369ebae7eb903e773a00
- SHA1 7b7f0bf8a1f58fca36673d3d2d5923e2e3852018
- SHA512 0342a7abb59a6a0bb6d2b245809a7ad7f90260a04d40f4c3f29f843279fbad20561e55e2ff74510b97ff83f8deef10b3869a563cd599fb42dbe37710f9033b16
- TLSH T11471A338C78309A1D76174B290FD0F24797987E8FAF31D85D86869396F1B350C3682D8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59137e.TMP
- Size 3KB
- SHA256 49e76d1ea5e1b92fa8bf3d80e66ed3488567e95820c7e0508853d8f6da651045
- MD5 468ff70a55527f7c8ce1c6c463849e99
- SHA1 971fecd51b76a70011d5f6d8dc9fa01ee0ff31e6
- SHA512 7eecf2d24d51fbb28056503a1c5b1225790bdfb300ea2d188d4b2bb278e0ef14b7410909630959427b0983938152d6cac3a6454036f3e11b5b29b80f04591da1
- TLSH T1DA618138C78309A5D76174B294FD0F24797687E8FAF32D85D8A829346F1B751C3682D8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 832cad8ee087b5b38c062cce73f4b569f4b1d46b3157f8b6e670510b4c9c3e94
- MD5 4876db8f3d275c7e91da70de55ebba93
- SHA1 b7f4a4b0317ca9622ac9ead7bcfabccecae86247
- SHA512 3b36615d45740fafc989f7e2899746218f37e6d394ee3492858541ec865f391d12e1a6f4191c7d2bd6ddba646d6e0f09e24427338bf4284ae3cebeea49833325
- TLSH T19231C0F783E5856ED91256F0AA18BE1FCE1D0516832C3C598AE0EF17A3E3075E102E5B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 3b04bd4c53f9393502b8b584885789e2c5fcbc1bc31b7fe3b56e089757a888c8
- MD5 c5b8fce7c4cdac9d2f7ba31dea708e4a
- SHA1 b629223719c8f438a3340935a89eb0591f3614a6
- SHA512 77627086f061b662d2699a1e7e34b82a969aa81e31e12838eef9d18b48894cdb6291de591e9dc5d2ef545158dd5dd1f84278522e6e987e167e796f9b5f822d86
- TLSH T12631C2F783E1896EDA1396F0AA147E1BCE5D0505836C3C5A8AE0EF17A3E3471E141E4B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 1557f0111a4b3c1882ccb0629f07e057207556b81367c5185a19b7ed8a49b9a8
- MD5 3870b1c8e00991a62d04050859d692cc
- SHA1 57259e58c8b706319ed0acf7c8613799450b1b98
- SHA512 52417a924a071557d0de4dc0058e5daf1c45639df0d6fe8ea7a9c4f83cac1b6e60454cfe84894438b5bbe88582a84e53d2cbabb3700e83fe418cd080fecc6852
- SSDEEP 192:sxZBRmyM/jK1Ml8Mk2/fesmKW2u/IdpYel1HW6+WNH+w//Yzo4ZAUIgrJ:sxZB4M2/fesmKW2R3Hb5/aJ9
- TLSH T1B152D8126A345977CCDBD209FA45BB93D6F94563D6910E44AAFCCA0C00E6BED220782F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 16d0e040587d83d503827b8cbe49b7774a739a62ca7c8da308058c0cfca8f243
- MD5 e0febd5bae6879a11ef9641c87b549f5
- SHA1 dd3313350107ec84488b927bcb6f74b0fcc0e99b
- SHA512 ca525ebaaba9a346d68efcdfd8421963c0f53857502d0ad8a79d7f7a366f057b7ac03993d00882666b2c7617be975961d0ae21030412dff1c7a08bc59178c6f7
- SSDEEP 192:sxZBRmyM/jK1Ml8Mk2/fesLKg20/IdpiCUUl1HW6+WNHGFDLXIFw//Yzsx2DrAU0:sxZBYM2/fesLKg2jntHbmwK/TWJ0
- TLSH T1AE62E8566A345977CCDBD209FA41BB93D6F9457396910E44AAFCCA0C00E6BED2207C2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 15KB
- SHA256 b3b2e2c95610f87a5ce82978be8f0b2f5275973fdf4fe66ac72eed46a6b41786
- MD5 cc2b7493b2f92a093adb335769efb650
- SHA1 ed75565a0e71c0340a023bca4f2221598da50d7a
- SHA512 ee0a31fb62746fc1bcecd421602d213a40729311022dec18eed2712391a9c7aae1cbca5de593e2551e696bd95b11bc4eef2fab2b04f759ed2f6c6235ddc60767
- SSDEEP 384:sxZBY02/fesLGWv2g2YntHbc3LJ8/vVwe:sp32/fRGY2ghtHbc3LcvN
- TLSH T11772E852A534597BCCDBD21DFA45BB53D6F8042796A10E44AAFCCE0C01E6BED220782F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 30KB
- SHA256 07aeaa4e4caec2e99aa1b5dbfc4208448bb103513d2532e90ab55c88e4c84a76
- MD5 b317c433bf618dae13391beafcc971b8
- SHA1 2dc94303feb5fae5740cb7c070e09a0f6e78e363
- SHA512 d06b23a4b335236b707c02d8918ad33686f8ffcad7f3999cb1fc4e62e0354b7bd1feb736d18e3d4a4698f22d66e1991692a8582f1cb3377870e02cc755ae9162
- SSDEEP 768:wfW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjzroIpiUYU:wfW7kf0Wvqidau1jaa5LA3jArU
- TLSH T1D8D20A3B680CCB7E4F841E5CEC266F966ED801CB66988D5487FA884C03CB6EB51175DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 4KB
- SHA256 1de325a9d29ea1471a7200bf289f5000b81e5e7a0d98afc8bdd4ff8e1fb608ce
- MD5 18246ce517d08396e5d5e28ec7cc3078
- SHA1 6bd0a2fdaa89baeb2942e7dc0cbbb16a56295ad3
- SHA512 8338932b06009f37132caba304abf7b79064e5257399bb3869a1dee695375e8779f57a5f772b73d4e4baf07a7ff9178e911f3408d78ea89a7d25ae00df1b1949
- SSDEEP 96:KIbCKcTIwK1K6aCgKT6ktcZdL/Tkj/KP5lkKxB5j:s0/PBtcZdL/Tm/KxlRB5j
- TLSH T148917716313A0E5638BE294DB19696375F8232633015756F3FB804A21E6BE214EFDCDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59af70.TMP
- Size 3KB
- SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
- MD5 904e6e94a1d46374c8630cfd86cc729f
- SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
- SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
- TLSH T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 19KB
- SHA256 d05c57f54e0f57de2a948af43250405b0debfa676d65c442093d583ea7b9e85b
- MD5 98535354c6d43f93737b95a65e8d83c0
- SHA1 b115ffc8647180f695bd93f145699344ff8f3a2f
- SHA512 eac0741220c985f247d73f093f916b5c010bbc3f04037e17d0fa6e227a6cf17ed52c10dc20e911c6eea95c4162f0f20370e9bf9d32f0683361e6f45dd621b3e1
- SSDEEP 384:vtNn/s3n9SfsNYJz3yb6QpMdtp5CEJr3TOObjI9G6w7N:vj+9Ug/mph3T29MN
- TLSH T1DA929D326C355E375993A155F54B3A179FF841BBA7C52F88E6DCAF0C01EA6AC0312816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 27KB
- SHA256 eea77458d18497fe41edf41c5241e2e5ff172ff2dbdf88336d45e9b9cbd17e88
- MD5 f7be59f7a0c544dfa02827aa2ba6efc6
- SHA1 f6517ed11a24f239af2fdb0e13513f4d1be21cec
- SHA512 7428de134c71560558d72066a3112d1120cec7e7aa1524f2912965f2dc0140ed92c88067c34e9967c66bdd8f518cd8d16580215f45430d56c97151bf8f9571b4
- SSDEEP 384:HBiF1tNn/s3n9SxzsNYr8TUNTUlIlO3yb67pMdtp5CEJroTOObjI9G6w7N:HoF1j+9eDwgjsmphoT29MN
- TLSH T116C23AF258D7893AD99E5747F77E2D068EBCC16BB5852A44B3C89A0CCC961BFC302815
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 33KB
- SHA256 574483119d36aff3de89bd56137be9d1f5abe283a08f65406e9b23ef0bddea08
- MD5 a26bbb272ea4aaf4baf16008daab71d8
- SHA1 718bef3786eeba18dfe0043d1d00a4ba198ed161
- SHA512 cdb8719ae19676204fe0034dab3d840ea180367aec5ae519cb0916c79463aef8a9f5fa08d909dff34e1e181c7a70177f8d9f7b3d49a567fff4f5d2cd26e19de0
- SSDEEP 384:HBiF2tNn/s3n9SxzsNtr8TUNTUlIla3yb6PpMdtp5CEJrJZbASt4egvoFV9THm5P:HoF2j+9e6wgTCmphJWS5FV9Ds29MN
- TLSH T186F29EF188D74DB6D4AD9BC7A73DAD061ABCC17BB4855908B3E4A92CEC5A0BFC311811
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 d71239477dc7a62708867878e170bba6e2a271120526a8b7928c500bf67e113f
- MD5 ce5273f5888b452d1477d7004da76a05
- SHA1 9683fb6c463f50686f0f78268a13614d28b35d02
- SHA512 98a5f8fdb7c00300ed49e3765ff9de93d0eb5fa0101132791e3e5c54191be02aebbdb0f508d397801de904cdaa2452ba30f3d0aacfc4c99e739fd08b5d483ba4
- SSDEEP 192:xONMo64B+QmiUyi9L5GBPKK7+FdG29p9hFC1SJr/WwKqbU6:xONMo6e6dLLdtp5CEJrrTU6
- TLSH T1DC120936AC749C3B6DA2B145F58736035FE8413BEA856F50F6EC6B1C01EB66C2306856
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 19KB
- SHA256 993b32aaaeeaf7d598baab7dcddd895a94082de08db0778e449a6f7e12e51c69
- MD5 5c2c3e8efc6f3ec293132e1a22cdf57b
- SHA1 952611774a2560a6eb2d0b54af7c4774c8570319
- SHA512 cff0040f600bcc895c5cb16ce6007f4cdaff4bb976341b22911a9b970c634b118f4203ce1f8183a95bcef0c8d54b49cc018fa0025a7628cf03cfe9fb2f86af45
- SSDEEP 384:fEtNn/s3n9SfsNYJO3yb61pMdtp5CEJr3TOObjI9G6w7N:fEj+9Uvmmph3T29MN
- TLSH T1AD929D326C359E375993A155F54B3A179FF8417BA7C92F84E6ECAF0C01EB6AC0312816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 d32ace502f92a78728f48f4d59c5157ed9a9cf20f72a21bf89b400adf89749b4
- MD5 3881cee137527a187a1556f3412fe1bc
- SHA1 a8c800e45f9e06dc90d83f4d828bcb97d2e8a005
- SHA512 3729ae8c020046d8590959725c5b9e6bf102b3f13b7e39e4cadc3b2e5e8a2dc8e98ee49a259902525a4a02285c6066cae9451dfc7128711ed2adcfaf1b4084ea
- SSDEEP 192:MONY64BAQmiUyC19W5GBPKK7+FdG29poaDtUxU6:MONY6eAlvWLdtpRwU6
- TLSH T1E6020935AC796C7B9EB2AE45F58637175FE8103BEA815F44EAE85B0C01E765C2303827
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
- Size 264KB
- SHA256 2a11f87836ed7dddfa19bab5a7c73cac4e2ef35009c85d9397d93460eff8326b
- MD5 920a7386c0fc85b2e72439d2c10facb0
- SHA1 ed264fc282277700dfb5fc717d889b859a8d71b2
- SHA512 7829d16663a9d5b211af7fb4ecc68decfebbdf0f2373becef28521730cc365f5480d7d425415bfcd1a908f1a8a96d6430a079bcc21efe6f6d5ee9b7618afc14e
- SSDEEP 3:MsEllllkEthXllkl2zEXUdq:/M/xT02zyU
- TLSH T149440444FFC44C45DD0033334013C3500770D4140531D7433C5144177CC75C00C00101
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 faf486d51693ab54effa486e2a6dd4b83320a056dab47eb8a903ece3c38a9a1d
- MD5 672cc34443a9311969d28682d4ec12b9
- SHA1 1fb3f242203b7cb5abc3b0ccf37197a5d005cd86
- SHA512 ed7aad4eaac32f485e850c631aecea6d47397fcd46041530a86d68a541d6730e15ca5f5cf387bfcb7822972fb129785cbaa232d372e413e549e8394473f0c7fc
- TLSH T197412E5CABEA1148B3B76F1A6FF6A46D587A7D272F06D49D00010E4E4A63B40C971B37
- MD5 SHA1 SHA512 TLSH