Analysis
- geolocation tags
cacanadananorth-americatoronto - user interaction
yes - max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 15:51
Static task
static1
Behavioral task
behavioral1
Sample
watch.html
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
watch.html
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
General
- Target watch.html
- Size 1.2MB
- Sample260712-tawcasev81
- SHA256 e8b1b3222a3e35135bfdfc95d15504c6a6b450fee9239c169d443bcc88aeb4e9
- MD5 8212fbc32ca187986deefdae1561c903
- SHA1 afe1c284f6d08e7fe84569c74e279c60f10ac4ec
- SHA512 1cb72f8f8bb3fcd8f503f5be7fafc83f399d5ed791a878788967b50b756438c14a1a70ee75484426482d3e5028d699159f3b73ca7cae66244220caf65d713563
- SSDEEP 12288:UmnZanZdnZ+nZ1nZbnZ2nZwnZjnZTnZHnZmnZi6qC7Xv7xiggK9lmcR+PU:Uq6n7XvbgAlT
- TLSH T10D55C314146878B64987A143DDF5FE3F5AF023288BC8996EBCF7EB4C01ED6480DAE516
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2092 msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283451184885579" msedge.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{C016EE85-BE23-45D5-B390-C6BE78D85724} msedge.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1704 msedge.exe 1704 msedge.exe - Suspicious behavior: LoadsDriver 9 IoCs
pid 4 4 4 4 4 4 4 4 4 - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe - Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe - Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2360 wrote to memory of 4044 2360 msedge.exe 86 PID 2360 wrote to memory of 4012 2360 msedge.exe 88 PID 2360 wrote to memory of 2092 2360 msedge.exe 89 PID 2360 wrote to memory of 4012 2360 msedge.exe 88 PID 2360 wrote to memory of 4012 2360 msedge.exe 88 PID 2360 wrote to memory of 3832 2360 msedge.exe 90 PID 2360 wrote to memory of 3832 2360 msedge.exe 90 PID 2360 wrote to memory of 4552 2360 msedge.exe 91 PID 2360 wrote to memory of 4552 2360 msedge.exe 91 PID 2360 wrote to memory of 4552 2360 msedge.exe 91 PID 2360 wrote to memory of 3588 2360 msedge.exe 92 PID 2360 wrote to memory of 3588 2360 msedge.exe 92 PID 2360 wrote to memory of 3588 2360 msedge.exe 92 PID 2360 wrote to memory of 4420 2360 msedge.exe 93 PID 2360 wrote to memory of 4420 2360 msedge.exe 93 PID 2360 wrote to memory of 4420 2360 msedge.exe 93 PID 2360 wrote to memory of 2000 2360 msedge.exe 94 PID 2360 wrote to memory of 2000 2360 msedge.exe 94 PID 2360 wrote to memory of 2000 2360 msedge.exe 94 PID 2360 wrote to memory of 5732 2360 msedge.exe 96 PID 2360 wrote to memory of 5732 2360 msedge.exe 96 PID 2360 wrote to memory of 2660 2360 msedge.exe 97 PID 2360 wrote to memory of 2660 2360 msedge.exe 97 PID 2360 wrote to memory of 3284 2360 msedge.exe 99 PID 2360 wrote to memory of 2780 2360 msedge.exe 102 PID 2360 wrote to memory of 2780 2360 msedge.exe 102 PID 2360 wrote to memory of 2780 2360 msedge.exe 102 PID 2360 wrote to memory of 5888 2360 msedge.exe 104 PID 2360 wrote to memory of 5576 2360 msedge.exe 105 PID 2360 wrote to memory of 4528 2360 msedge.exe 106 PID 2360 wrote to memory of 1220 2360 msedge.exe 107 PID 2360 wrote to memory of 1220 2360 msedge.exe 107 PID 2360 wrote to memory of 1704 2360 msedge.exe 109
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\watch.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffdbd64c188,0x7ffdbd64c194,0x7ffdbd64c1a02⤵PID:4044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1924,i,2631774372339513310,5133318805849510734,262144 --field-trial-handle=3084,i,12696712063844343477,746267043453977564,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:22⤵PID:4012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2136,i,16140293296674642852,12531701832293972277,524288 --field-trial-handle=3084,i,12696712063844343477,746267043453977564,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:112⤵
- System Time Discovery
PID:2092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,4661338113600014169,10458024882454612447,524288 --field-trial-handle=3084,i,12696712063844343477,746267043453977564,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:132⤵PID:3832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,17115699260572857247,16915771378715846588,2097152 --field-trial-handle=3084,i,12696712063844343477,746267043453977564,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:12⤵PID:4552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,13586049719430861594,16538007214158911330,2097152 --field-trial-handle=3084,i,12696712063844343477,746267043453977564,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:12⤵PID:3588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,8235440989290757146,7924593592199994714,2097152 --field-trial-handle=3084,i,12696712063844343477,746267043453977564,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:12⤵PID:4420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,1088223525092954326,5199121085023147568,2097152 --field-trial-handle=3084,i,12696712063844343477,746267043453977564,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:92⤵PID:2000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,813803907635981465,1965500362117134341,524288 --field-trial-handle=3084,i,12696712063844343477,746267043453977564,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:142⤵PID:5732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,15329206415935888467,3799100641932535884,524288 --field-trial-handle=3084,i,12696712063844343477,746267043453977564,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:142⤵PID:2660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,7291179830834551089,5933992873324307382,524288 --field-trial-handle=3084,i,12696712063844343477,746267043453977564,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:142⤵PID:2916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,7291179830834551089,5933992873324307382,524288 --field-trial-handle=3084,i,12696712063844343477,746267043453977564,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:142⤵PID:3284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4440,i,11533987627913455811,7736351680066936851,2097152 --field-trial-handle=3084,i,12696712063844343477,746267043453977564,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:12⤵PID:2780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,8241383161975473309,8156371922052027792,524288 --field-trial-handle=3084,i,12696712063844343477,746267043453977564,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:142⤵PID:5888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,12333454781543868593,10398867523275117732,524288 --field-trial-handle=3084,i,12696712063844343477,746267043453977564,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:142⤵PID:5576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,12294661665014860303,11497791184638054167,524288 --field-trial-handle=3084,i,12696712063844343477,746267043453977564,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:142⤵PID:4528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,16209465655468788674,12657486139171538058,524288 --field-trial-handle=3084,i,12696712063844343477,746267043453977564,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:142⤵PID:1220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6452,i,16189257419372368877,17586352724110997112,262144 --field-trial-handle=3084,i,12696712063844343477,746267043453977564,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:1704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:1096
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:684
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
- MD5 5e53a2cd139f0cce4f8ceab3e015f7da
- SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
- SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
- TLSH T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
- MD5 46a6445fd2c83830bb8c6e03f85bafc0
- SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
- SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
- TLSH T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 5ae0c507ea8b648f19fa8229b4779abf8e2704240ec49fe2c1ec6481af4c8c79
- MD5 2055bf0b6c97e8c863d5588cada28394
- SHA1 a1a8a13ce2bca020a3677f86efbf00cf1eea58fb
- SHA512 8aab569252e9c6fe55927cbdafa7dac0ca2e33513e7ecb5516c4d37ac57d0dcaa8a979b4bc95e0a602b4fac4d007988d4c8de924bea9a61ab5a90a9f267e3000
- TLSH T1F051D69E03321AC0E7A760B664E4158933F6A60A0A0B5E335750AF337A4BF19E1FE103
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a2d1c.TMP
- Size 3KB
- SHA256 750183355df32eb1ce4e3bb7c845757788ed4350fe9712c72c45da107afbb4c7
- MD5 b88c00957187d5594d519776dc87936a
- SHA1 d954c9ee3070b848c910c0166fde0528cc43ae91
- SHA512 4507ba901c0ddf337b924378fbd2f7563ae33f2f69ebfc8f5e9a21f6b14b3ac2bc88aed9207c0cfd20f8a0d31267c463a509f9cfd8af7ad71b1baa4e8e748f0f
- TLSH T14351B69E03221AC0E79760B664E4558937F6A60A0A0B5E335754AF337A4BF19E1FE113
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 5KB
- SHA256 1a9cf44bef7496c6a087866db4b3e4b98f2928e4967a7a748cc8221875b2a0e3
- MD5 0cc6eab29e58d9abd2212b7dbe398ad9
- SHA1 7a02284c8f5918d2146063f8a75defc6cef59c3d
- SHA512 b056631026c4e4ca891b889c83630308f7ff1ad634925cf32dbe888c180adfb42f61bd5026978a97ab96f27ceb122f6e14f07d6c24c5f610f0f346848af7b4df
- SSDEEP 96:DeO30YVAv0aJa91WiNjhm14zBwBj6Cwt5sK+s/u1ahf5p:DNk6Av0Ya91WiNjhm141kj6Cw0K//u1m
- TLSH T189B1AEF7C3D8867E881156F49B257E2EDD2D151A42283C6688E4AF5F63E24B0D101A9F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 385966ab0642a9e2205ce59b524ac90ab7987428e9da36ca72b61b3e007d611f
- MD5 9a75b3c392393aa9b30eabe5515930b9
- SHA1 e912f2fb4b416e208749d1f72c7267140ec68f5c
- SHA512 08e534e84094906db6f28af7837fd6694f34b5f60e5b9dad507b73acb4017de2cb1db62472f5caa241767869774dbaaacb576be2c811c4be9f80bca01a86f574
- SSDEEP 192:sxRQRgyM/jK1Ml8wbY/fdswY8Dde5lSRzoD8p4o/g6+WNIYCyuOCtGJIgD6J:sxRQSlY/fdsV8c5lU1/5IkZ6
- TLSH T17E62D91696245D7BDCDBD209FA41BF93D6F81573A2901E44ABFCDA0C00E6BED221381B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 a4424e4c646a632c8540db690c6bbb906e0872593567f816bb4ac6bff5c005e4
- MD5 56ea6fae78544cb75548704592de0aaa
- SHA1 5bf6ce833c55b0a3e3bbc53e8eb5be8cc2055e0b
- SHA512 4acd86ebf86cb3f29dc013db24d379e08605627d2fc468bcda2a2341d92b11cf4552c5c298c443fa23ee629899c7037c81ca3d804515d6f79b7a874abc1f9394
- SSDEEP 192:sxRbRgyM/jK1Ml8wbY/fdsIYNDde5lS0zoD8p4o/g6+WNIYCyuOCtGJIgIJ:sxRbSlY/fdstNc5ld1/5IQZs
- TLSH T13352EA169A245D7BCCDBD20DFA417F93D6F81573A2901E44AAFCDA0C04E6AED221781F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 3e95a091a406c85a47281ae8e71e7526c2888ad6aa0c79b5c1799dc20102b4e5
- MD5 52465d5d0553b794ea4bd798d52458db
- SHA1 c5f69d749f9699e3aa5038d309d1c7d11560b99a
- SHA512 75b39139ce7917207303860c480fb91455f36ce6e1bce56b05538cd32ca227fee2889ed607eebc8b44f0d8b9e73cb43455bfc9941e6e23bc5940e33226a419e3
- SSDEEP 192:sxRoRgyM/jK1Ml8wbY/fdswYNDde5lS0zoD8p4o/g6+WNIYCyuOCtGJIgDoJ:sxRoSlY/fdsVNc5ld1/5IQZw
- TLSH T1EE52DA169A245D7BCCDBD20DFA417F93D6F81573A2901E44AAFCDA0C04E6AED221781F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 4a681d6f87557b542650e1d60f943a66f48cd139f72a45b67d6a3effdd50b0b1
- MD5 cb05ed110f84d234d3ab1079a47fb248
- SHA1 d5032416da8f9752e192969e72e6e7e89e1e397d
- SHA512 2838711bfe66ed6e2055cd10637ec21d672ab81f2f3851327768c4e961bc5cbc235ca1f067f6cef359a3acda228bb38765651bfad05c4045992bbb440632e28e
- SSDEEP 192:sxRQRgyM/jK1Ml8wbY/fdswY8Dde5lSRzoD8p4o/g6+WNIYCyuOCtGJIgDrIJ:sxRQalY/fdsV8c5lU1/5IkZE
- TLSH T10162D91696285D7B9CDBD20DFA417F93D6F81573A2901E44ABFCDA0C00E6BED221781B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 fa9f05681484990f8b96c4aeaf4debc3a9e3562972bdca58024be09996401b41
- MD5 e912d90d14b8e7440edb60160a29ccf4
- SHA1 90cef1d27bed4d12c0bb5bcf36157e466de46283
- SHA512 f59ac1c17bd31fde30108781c32b6f8850d045917c2e3dd75f15cfb5877343ae40de1386fd7721ef54bbdddb4bac6b8bc0b711620d8927882f6a75c96e45d0a6
- SSDEEP 192:sxRQRgyM/jK1Ml8UQgbY/fdswY8Dde5lSRzoD8peo/g6+WNIYCyuOCtGJIgDrIJ:sxRQaqOY/fdsV8c5lUX/5IkZE
- TLSH T1AC62E9169628597BDCDBD20DFA41BF93D6F81573A2901E44ABFCDA0C00E6AED111781B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 27KB
- SHA256 41cbd2116943b5df53cc057cff26ff66490dfc67d46529a4d51cf496158e6f00
- MD5 6c4508432a565696f2eeccabcc3c665d
- SHA1 85b2ad057b2862c2a5c92655fa9242e16715b5fb
- SHA512 e2b9aaa1fc6d6967d0d0c137904644280a07ba03cb4304c014a60f433f912509eee571cb5b65e5491f9bdf30080b60519d75690e960d47e480805f9790ce8f8c
- SSDEEP 768:j/8vrQWgQ+fB+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCQqqmrovk:j/8vrQWgQ+fB+u1ja3Vqds
- TLSH T180C2EB2B640CCB7E4F844EADEC29BED66DD801CF5B588D5447EA890C03C67EB521A4DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\00b1619a-3620-4e00-9e77-6e047d8a1f10\index-dir\the-real-index
- Size 1KB
- SHA256 df00219f9da3571f72a212538edcd9131be58ab25bc48886a9822cac0cf67777
- MD5 9b681a03f52cfa97048d7656856ecd8a
- SHA1 0c56fd8eeefa2b0ad9473f39bc4f5f71173e15ea
- SHA512 722e1185add8d5e05d9684eac1e871718fd5a5d29a1543d2fe5bed80225e3c1a1c286c39807ddb9d35a2e9a61ac159491ffa82891961f969505a0b4caa9e5a1d
- TLSH T10931638CCC806BDEE47051FA2A9405F2A7B52D28FC0DC35086A8767534027A45B875FC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\00b1619a-3620-4e00-9e77-6e047d8a1f10\index-dir\the-real-index~RFe5a8dda.TMP
- Size 48B
- SHA256 ba8007dfd6472ced18a097dd6af4cb7f80f90dbeb79e9313f7186b95ab693629
- MD5 f1bd1b0517772e38e508a81ab4449b1e
- SHA1 332f28b0340ebceaae89f1f8891990187fd2790c
- SHA512 71a4b4d70f6d32688600365316efc7bb11fc85e6aaa2cb8f72caa106f85064ffe73664b6fa5f22a13ffc0681fb8ea2d7b22e3216d6f63e6b342f2a78111e6bae
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt
- Size 189B
- SHA256 542c524a586363ddd5766b39b05e50961b70a37e1a00c440d102010089f87d2a
- MD5 985b5de5743926aa4c715e8eac677412
- SHA1 261461b5dbf62f452a5b6f41e0e5743bde109136
- SHA512 f5b2cb703d6a5df76993be3f497df35e638afde6adc5ef2c4b56e123b778e0f7491615c318f89ffa8917b9284541047efa320c86a32dfd3a017eca99de9cd82b
- TLSH T147C080C145733D7333752B5151240C6D08697C02A9147944F89F737721FC613D5A4675
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt
- Size 98B
- SHA256 0433aa9fbcf3bc86912286b207b2e7bff9953945df9ab89ddc53159a2908f45a
- MD5 6145fa305cca86790d4ff6240d02d0ba
- SHA1 a617c71e7eb504d592f3e4f56d52f3ebdf3354b9
- SHA512 ab42af46b321e453216d97dbb8b09429605465a44d45d46d4e8228fb21cc456a7fc948418bf7db9e10a4e117c61792f438a845ca41b582b6fc047c05d8a6eeb0
- TLSH T176B012D155316D7B13B86B8511480C0E1D5EE102A5297588F89C0501003082394D04B6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt
- Size 100B
- SHA256 2f8971a5f714dab7e5de9a21317c6f6154abdcd2177a8328ce1efb284856429a
- MD5 eba55386d8b3db133dc0d9bf671024d3
- SHA1 9fbaabb18b6504cdf2634eee7fe81e456cd68765
- SHA512 1fadb65187f4902fcaa3f1cb23296fc49677c9209fe5eaba0fc6e1660fde6b6520613c7bc1c01baffa3e7f0f442a01bdb2ec80f56a0240f6446439237157ab2f
- TLSH T191B012D159312E7713B8278911440C0E1D5AE402E46875C8FCAC0541401082344D04B6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt~RFe5a39ed.TMP
- Size 105B
- SHA256 261b77c3bd157fa740c98b5763fbc23f2b7bb1d9b0e8162bc4fb54b7ae374d45
- MD5 2665c317f21a841e1aadac27c272fa8d
- SHA1 9d89d07e836213eba03a990d5b1a9970b596d924
- SHA512 a28fc090bf2d09366f919f16a84af9795d5929a53c74651627c2c01e49c12ace5ee3c04a4cf32eea95212a446c8081ba38fdb953cae8294469dea6ce0b80a7ed
- TLSH T10BB012D155313D7713B5278211640C0E1D6AAC02A8187588F89E3601103082385D04B6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\571500ad-26f6-4d91-af60-94b9e5654459.tmp
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 38KB
- SHA256 8b925065e954271088109cee52c8d7c2316fb71651edd5d08070cf96072c8018
- MD5 091c55d1505d4a88d88b8525b800637a
- SHA1 1aae21e6fbb4847202aa9c40964591174fada20c
- SHA512 801edeeb829df8474bd389a1831e76cb14e27fc56cb9fb8b8d7d6467cf97f81396720dbd1790cc525a1bbd8dbd5b2020c9be78525433a143a2b20e7f4b8cd56b
- SSDEEP 768:erv+4UNbd93opLHz8p8+p3bd66j+4BRv86aLIWbKjJ:ebsb33Aza8+p3Z6n4yJwJ
- TLSH T10D03BE72F8A8E9739CF6C684B14676437FF8519396C01ED4D9DC6B4E019B0AE630B923
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 34KB
- SHA256 5850923c97940fd48db1a22678aeb3bbbf3a9414d0588cd9ba2865fcb5494c2c
- MD5 bfff7af31636ddd7d1f25a0a8d5dd5b1
- SHA1 52f595ffaa26f901aacd2576f3b7754354c8908b
- SHA512 ffb12935bdbd6a503789d17c0a6dd40bb6c8932a8e354233041b16663692ccccd9ec1aa1dda251ee83c7de21f6e4c1fce2c0174818ae1c2efae2745abf060312
- SSDEEP 768:Dur0h6M3WlLHz8p8+p3bd66j+4BRv86aLIWbbkC:8+P3Mza8+p3Z6n4yJ9
- TLSH T1F4F2BF73F8A49C739DD6C6C4B1467643AFF0119396C05DE8D9DCAF0E118B2AE670B826
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 37KB
- SHA256 92cf16df3303a3452619ea895a2cf9becb8cc039afdda2072999cafdc6be2733
- MD5 e2f21cd2517e9e4c23d1449ca2398965
- SHA1 44f944d40db0f6423d96fb8c679cb1d82052b0b3
- SHA512 d15ce98ed7e2291262509ed7df187ee5f6b1b1e88bc57a673c1839cdc24311bbc01f9604b07b3a8f6b8be62466a4387ebb2183ad503913dea44edc15d69fbb9a
- SSDEEP 768:SF1ur0h643swg4TLHLp8+p3bd66j+4BRv86aLIWbbkC:N+f3Lt8+p3Z6n4yJ9
- TLSH T10E039E73E8A4D9779DE6CBC4B15A7243AEF01193C6C059E4EACCAF0E119B19D530BC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 34KB
- SHA256 1fe6f77ecbe7a1e1a551aecc7e942f0b29d04cf3f775b8acaf501e703c5ef6c7
- MD5 7f35a9655c73195d4f0e4a9672447b2a
- SHA1 aa4657904368ecfbffc37a198426c16eaf8d8253
- SHA512 e9b53a8654a7b59be51f499b07dabe4ca1e9b3bca02d581ea1693fab916e0e9ad9a225fa15e80c8b7046cdfccf8c091444aefbd44b08aa87a300cabfa7cc0225
- SSDEEP 768:iur0h6W3dTLHz8p8+p3bd66j+4BRv86aLIWbbkC:f+R3Vza8+p3Z6n4yJ9
- TLSH T11CF2BF73F8A49C739DD6C6C5B1467643AFF0119396C01DE4D9DCAF0E118B2AE670B826
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 38KB
- SHA256 2810ac119345b7e6a37982f6fc127ca139beceaeb2878e9430206f10e606b5fa
- MD5 bb4479c09d10ba968852c0f9b70dc149
- SHA1 c777d31bf009a90f078e2356f0d6b201f9d0898d
- SHA512 7209fd34bc21a9012a8445b7a2b3ebb34d68b29c8645fc6cdf22a6b7f2c6f19676a86b680d959d0c90a2a9831d79467c566fb74fcc0e8ec6918b83025e45db4f
- SSDEEP 768:Irv+4UNbdD3CceNp8+p3bd66j+4BRv86aLIiK2bwCl1:Ibsbp3QL8+p3Z6n4ys0ww
- TLSH T13903CE73F8A899739CE6C644B2467A437FF821A396C10EC4D5DD2B4E419A19E630BC27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9363dfb1-0ae2-4b6c-b109-0aa70d94f1bc.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512