Analysis
- max time kernel
150s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/07/2026, 04:38
Static task
static1
Behavioral task
behavioral1
Sample
watch.html
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
watch.html
Resource
win11ltsc2024-20260710-en
11 signatures
150 seconds
General
- Target watch.html
- Size 1.1MB
- Sample260721-e9p71ae17q
- SHA256 36bc33f7a17da5ebc7c3eca08fa1930bbbfee9b5c93aadf4451a55836f3f46d4
- MD5 0af025d0c742e6dc395b18b982816706
- SHA1 df183f86c3769c9483d13568b7dd1bfadf503e37
- SHA512 37918614a892a6dcbf0cf49b114dfcc0803dd2918e6c93d1598c7cf3cb9ae7fc42af2ca5d6caa4cbd80d7e4dbfe84ff89cb60fa3a34d27feef7c1bb60b7f194f
- SSDEEP 12288:RVYtgztgMtgXtgQtgetgttgjtgGtgKtgutghtgRWuqZ6Lknb9:RVyWuM6LS
- TLSH T134359224186868BA9957E207DDF5FE3F5DE413284BC8D96EBCB7E78C01DC6080DAE452
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1568 msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290823320585947" msedge.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{E7BB8A28-1615-494E-BAF7-BDA918923EC7} msedge.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2648 msedge.exe 2648 msedge.exe - Suspicious behavior: LoadsDriver 9 IoCs
pid 4 4 4 4 4 4 4 4 4 - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe - Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe - Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 4468 wrote to memory of 4480 4468 msedge.exe 88 PID 4468 wrote to memory of 1568 4468 msedge.exe 90 PID 4468 wrote to memory of 4792 4468 msedge.exe 91 PID 4468 wrote to memory of 4792 4468 msedge.exe 91 PID 4468 wrote to memory of 1176 4468 msedge.exe 92 PID 4468 wrote to memory of 1176 4468 msedge.exe 92 PID 4468 wrote to memory of 1176 4468 msedge.exe 92 PID 4468 wrote to memory of 2892 4468 msedge.exe 94 PID 4468 wrote to memory of 5016 4468 msedge.exe 95 PID 4468 wrote to memory of 2892 4468 msedge.exe 94 PID 4468 wrote to memory of 2892 4468 msedge.exe 94 PID 4468 wrote to memory of 5016 4468 msedge.exe 95 PID 4468 wrote to memory of 5016 4468 msedge.exe 95 PID 4468 wrote to memory of 3868 4468 msedge.exe 96 PID 4468 wrote to memory of 3868 4468 msedge.exe 96 PID 4468 wrote to memory of 3868 4468 msedge.exe 96 PID 4468 wrote to memory of 4404 4468 msedge.exe 97 PID 4468 wrote to memory of 4404 4468 msedge.exe 97 PID 4468 wrote to memory of 4404 4468 msedge.exe 97 PID 4468 wrote to memory of 4928 4468 msedge.exe 99 PID 4468 wrote to memory of 4928 4468 msedge.exe 99 PID 4468 wrote to memory of 5172 4468 msedge.exe 100 PID 4468 wrote to memory of 5172 4468 msedge.exe 100 PID 4468 wrote to memory of 5912 4468 msedge.exe 102 PID 4468 wrote to memory of 5332 4468 msedge.exe 105 PID 4468 wrote to memory of 5332 4468 msedge.exe 105 PID 4468 wrote to memory of 5332 4468 msedge.exe 105 PID 4468 wrote to memory of 5392 4468 msedge.exe 107 PID 4468 wrote to memory of 5440 4468 msedge.exe 108 PID 4468 wrote to memory of 3028 4468 msedge.exe 109 PID 4468 wrote to memory of 1560 4468 msedge.exe 110 PID 4468 wrote to memory of 1560 4468 msedge.exe 110 PID 4468 wrote to memory of 2648 4468 msedge.exe 112
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\watch.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x290,0x7ffea611c188,0x7ffea611c194,0x7ffea611c1a02⤵PID:4480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1736,i,14847355632460748753,5453603598205550897,524288 --field-trial-handle=2192,i,12052987339563119542,3228155599682284335,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:112⤵
- System Time Discovery
PID:1568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,13417086241199160851,4901636356426532506,524288 --field-trial-handle=2192,i,12052987339563119542,3228155599682284335,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:132⤵PID:4792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,10263786600676220621,6355647676030843735,262144 --field-trial-handle=2192,i,12052987339563119542,3228155599682284335,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:22⤵PID:1176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,7630222240769768752,2574203231386463010,2097152 --field-trial-handle=2192,i,12052987339563119542,3228155599682284335,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:12⤵PID:2892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,3086602925861009041,2624754330735519484,2097152 --field-trial-handle=2192,i,12052987339563119542,3228155599682284335,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:12⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4372,i,12586686109485743252,13077328833013051016,2097152 --field-trial-handle=2192,i,12052987339563119542,3228155599682284335,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:12⤵PID:3868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4384,i,16860722558497798692,5503067412873271634,2097152 --field-trial-handle=2192,i,12052987339563119542,3228155599682284335,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:92⤵PID:4404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,16063401048673029055,12870652552676195514,524288 --field-trial-handle=2192,i,12052987339563119542,3228155599682284335,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:142⤵PID:4928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,5168126087990817503,17836093093149162227,524288 --field-trial-handle=2192,i,12052987339563119542,3228155599682284335,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:142⤵PID:5172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,17607267484541616652,2960919063683882229,524288 --field-trial-handle=2192,i,12052987339563119542,3228155599682284335,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:142⤵PID:4624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,17607267484541616652,2960919063683882229,524288 --field-trial-handle=2192,i,12052987339563119542,3228155599682284335,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:142⤵PID:5912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3600,i,1246966404898538789,3052054928119748114,2097152 --field-trial-handle=2192,i,12052987339563119542,3228155599682284335,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:12⤵PID:5332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,12859699945863411499,16338541687305132480,524288 --field-trial-handle=2192,i,12052987339563119542,3228155599682284335,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:142⤵PID:5392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,8574609546706915719,10729258435793843545,524288 --field-trial-handle=2192,i,12052987339563119542,3228155599682284335,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:142⤵PID:5440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,4685624191183245702,16807638318761757514,524288 --field-trial-handle=2192,i,12052987339563119542,3228155599682284335,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:142⤵PID:3028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,12944491367056432774,13339870752453062843,524288 --field-trial-handle=2192,i,12052987339563119542,3228155599682284335,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:142⤵PID:1560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6456,i,252705169194180739,18005545684522595691,262144 --field-trial-handle=2192,i,12052987339563119542,3228155599682284335,262144 --variations-seed-version --mojo-platform-channel-handle=812 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:2648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:4172
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:4580
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
- MD5 04925ec9b8ab191e010732cba0eeefe1
- SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
- SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
- TLSH T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
- MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
- SHA1 610df135117504b2857ee3cc03a5ac9797b10333
- SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
- TLSH T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 2KB
- SHA256 cb2e0faeb5524f484766b7059001b903768c92cb8b6ab99555c26cd713cd1e0c
- MD5 81b45e06447d1c6b685481532ddae13d
- SHA1 53e372027ac41f862f00f8b14e51cdd16d82b3f7
- SHA512 de69496ad8860eff61d8da3211798dd104d223cc946949497f108810ac83826613f32d8773e8b8d5e74871b70abc990ecdb5c434dba5c92399cdea4fa91a77a1
- TLSH T1815152A8CB2F0ED2D370D2B15CED45EDB67E4896C6076B1593F122B49B1230F2391861
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599735.TMP
- Size 2KB
- SHA256 ccf2a43ad401e291ad8fea5ac48b93cdc16afd9e71f9b8d44898e08d188c5c42
- MD5 c2f64a75fa9fa8a7c030cdb46feee341
- SHA1 6bb682dfc7c370c077ab0f06b5e368bb2e032b33
- SHA512 55acceef84ead6eed35019cb49e5ccdfb93d99461990a13292fcd97d0816a7915d8b473e28f71649cf68b194995e97e88c20bfb9fbf61ec2259411df80d648f8
- TLSH T1115163A8CB2F0ED2D374D2B15CED46EDB27E48D6C6076B1593F222B49B1230F2391461
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 4KB
- SHA256 b96297de11132bce08299d8776300fa388fa287629895e37ba03293d9a77d451
- MD5 dbec856690ebfab45d71a6d7a1c3ed78
- SHA1 5e108bc26fa6f084d273bb270a409f262b7024a0
- SHA512 32abd86d845f32ad675a74225115ed6bbdfacd0542e2186e442bb859521a6aa8b82d43258773f2c264ae731ad819c4e0c6114103c05458ffb948e2f66a46202b
- SSDEEP 96:DGGVGwhOkCYtpamWL0wzLH+0+G4tAaj5wp5p:DxdUkCipamWL0w3HD0tAS5AP
- TLSH T1C3A1AEB7C2D8876E880156F49B297E1ACE2D051A422C3C56C8F8EF5F73E24B1D14159F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 11KB
- SHA256 94981752f4b81df481f81273f7fa750da6b18f903b8403a8281014319e6d32ae
- MD5 61c6d2887d3f65c93cbe2fc74056055f
- SHA1 536eeb8d289b3f432aa6a580d4715a1c4fc7bd71
- SHA512 bfb46bc2c320d5bd7bd514e280eb917bf6500dfba8e50a44d4395fb22f95fe7fb4328532cbcca018c8ada8ae00e056c4915c329b5f2a67488521052ea3dcbb30
- SSDEEP 192:sxR4Rfb6/fWsUYlK/QHzoA8p4u/g6+WNIYZ7POsIGCPpIgDwJ:sxR4R6/fWsUYlKIu//5IAGVY
- TLSH T11642A6166928993B9CCBD21DFB65BF53E2F95062E1D51E48AAFC8B0C04E76CD620740B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 11KB
- SHA256 ea8b205bc6d4288367518d1817c5d3c88e3f73278556a5ba844c77923b10b17c
- MD5 e1cba1c9622a561fa3fd4283c232e04c
- SHA1 2934e805e61ce66b3c74f8ee3ecdad5371d359f3
- SHA512 339abb59d703978790c0f64f73fbf1a82773783e4ff8b78a332f947126abe62552799db18d9b967c2d927c40a585bc8a0c7a9029fc311ef5b146ada784358b39
- SSDEEP 192:sxRoRfb6/fWsCl//fHzoA8p4u/g6+WNIYZ7PKsIGCPpIgIJ:sxRoR6/fWsCl/Xu//5I6GVs
- TLSH T1723297166A28993B9CCBD21DFB657F53D2F95032E1D41E58AAFC8B0C04E76DD220740B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 11KB
- SHA256 48792cc97c69199501cee873d2fda882c6a35e4c4b9611f3dad2bb15ec64f146
- MD5 adf52a42e5f44fbe2661beda87d060ca
- SHA1 5f11b639606c3b4fc14d85a120c5824d52531ace
- SHA512 67d664c106f457e56d9f51d7e728d8bf7560888d099b4f5e01af350963ba32c632fe95ec8b265520297005bdf1b4011ca4aa50ac6e9d08f131ebb8e3ce93429f
- SSDEEP 192:sxRjRfb6/fWsUYl//fHzoA8p4u/g6+WNIYZ7PKsIGCPpIgDKJ:sxRjR6/fWsUYl/Xu//5I6GVa
- TLSH T1F53297166A28993B8CCBD21DFB65BF53D2F95072E1D41E48AAFC8B0C04E76CD221740B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 23KB
- SHA256 22c79ac52d095048b1ec15ca1e49eca65cc7febd6a1f7c30b24f8ecae5f81e90
- MD5 b2c9a4fbbaf96b635564c1a7b6432eca
- SHA1 253db125760868f38118d6a926b5128f4fdc8a8b
- SHA512 6d840fcfa8a558c38ade72a1fdf9c3a5a2cfa72526d060b9a6c9830639080727174d078fa1dfb3be191d36b392d10e34f2d1c336332047160edee329f345a1cf
- SSDEEP 384:kyr2SGXfCtgdDFf/bKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVA89VXR6FroOpr:ky2SGvWgd5f/b8F1+UoAYDCx9Tuqh0V5
- TLSH T1CFB2DB2B604DCB7F9F801A9DAC196FD67D9802C797588D4047FE990C03C77FA922A4DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\c598e024-e3e1-4b5f-aa6b-63ba618ce861\index-dir\the-real-index
- Size 1KB
- SHA256 2b0f21d34494fa402223b1d904fdbc27668c0e6532a5ace2f42f1b97673a6a25
- MD5 19c96590d30fd182e08a1133552f7405
- SHA1 c8c113466d30a691ab08075265766172b66ddce2
- SHA512 810b92ea2a17b3b4a5c174e52bf363377981ca60c695062f4b2c9605faaaca99658352be45ff62d23a64b24f059dc060e5f3edf38d035080e38062157f8bfd15
- TLSH T13431304CCC946BDED87051BA299844B267B52D24FC18C25081A8B1B534027B45B479FC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\c598e024-e3e1-4b5f-aa6b-63ba618ce861\index-dir\the-real-index~RFe59f69b.TMP
- Size 48B
- SHA256 939f8f23c726ab1c5ca901f84147d2f272ed41af7fa1514cc2e574df30994269
- MD5 ab27b2288ee839f89cfbf5766f90dff5
- SHA1 99822cecb4112e5d7d802900bdd49a30b9fee1ac
- SHA512 a2d80a314106b1414fa5a45512fa233af81dfe56a694babd95954049c78d5afc74701e94221a15c1584eb5bc6e71519abe7e7c9da2d01eafce512f88cd526d67
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt
- Size 189B
- SHA256 1de66a7074712ee98a3e5037a001e6f71181e825c7f8868dd6fdbfd76aad97a4
- MD5 fb2856159c22851bf4e392415afec9ab
- SHA1 c545fd8c8ffe03561f876704a00385c19956e49a
- SHA512 5810534effc712d73d5dbf3cdadceddf13e98c6f16390a7a29bead9436d84efb1fc3a7aecaf74772b35f46884b41cd63b69b6137bb475eb747e68a07a7f5d544
- TLSH T134C0228082B30E2B23930A11232A30C218119C41A8054818B585326730B4615DD071F9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt
- Size 98B
- SHA256 60c076cd8953699aa240c7e567f1a7d966e9297190f23df10005b50f7ae1e82e
- MD5 966cefcc4b34a47efe39f1430e6fd0ff
- SHA1 83318f1f2d93bdadad159e47b7f8a9aa38105bd2
- SHA512 004e67c7f2999f4003454e3be6f74a88a72f888498587a9d149b08e43fd5a532f8f997ba8a1aebb229078d2abbca82328e65ea53a9379ea7910f9b90ccb161d7
- TLSH T17AB0128197524E7942BB0F18130EA0122C4BD0C0E1209448F2DC000A2071B158D866F9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt
- Size 100B
- SHA256 73325048d42db1a177b9add2a9f1373066fd82b0ad67140b9c270588c1a7cfe9
- MD5 e66188c48320ac48084dbc5892edb615
- SHA1 2c946392703b9d602492671e8d75639f92fc9cec
- SHA512 fb6aeb8f5235d469c9b69795fb26d8c8a5e229dcefd3ca785a831780bf5f9203d6dfb7f2ff906ebbe4a7977df2dc7292a71665bd07bb30eb5b51915f66e53da5
- TLSH T157B012419B134F7582B70F1C130EA0122C4BD0C0E1E0E488F6EC004A6175A158C85AF9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt~RFe59a399.TMP
- Size 105B
- SHA256 7f6bb9b1872c9717a23368cff96c6fed8c109f721f8a4d0058e76d2b21ac7486
- MD5 c77790544e25885ca8de70f7e7bcd5ea
- SHA1 47dc97f36c773c5bec26fb87e058c9de192244ae
- SHA512 961a85dc8e5d87a7ee82be7079a6877b8d27bd90db1b2fd99162483d7d1e38b30b66dc41a688ee2545658246b2f7b92dfe2afab16e167e5c2cb201140247b72b
- TLSH T1EFB01241D6320E7543A30F15131E60522C5BDCC1E5109448F2DE302B3071916CD896F9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 4KB
- SHA256 4b2eb4705a111dd07520be556abc8654a5ab0b4a67f8857b5a2737a986f8888f
- MD5 0d67f8f666ed6656f4807bc9a91f8f5d
- SHA1 56af6abb4c0fa287a950d4b3b5f79b33930d079e
- SHA512 b217a0ba85bff54fd8cd55c678034660f4c4ee81baa59bc65a7091e12d02d36ea91599f348c7f60ea27627d0e80f997eed7cc5cef432993ade0d50739f81b8e5
- SSDEEP 96:Knob8YmCO8myBn0w8K8p0u8YIYh2IhhsfocSmCAmeVT0UAK8V0aAYEUl6DQYKZ+i:6ob8YmCOVyB0wUp0uVIYh2IhhsfocSmS
- TLSH T156911D8674BA46512CBE295891A1C566CAD271737058B43F3BE808B60F2BF074EFE5CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a32c9.TMP
- Size 3KB
- SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
- MD5 904e6e94a1d46374c8630cfd86cc729f
- SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
- SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
- TLSH T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 36KB
- SHA256 be4647e564c3f08956e5fefcd6161a5d9c5c3518dfe806345249b0ad86d7502b
- MD5 c46f16bae92a3246221a0e970832060c
- SHA1 4f886f50889b5a0f199e2b9713156d888f2690e6
- SHA512 dcc0216e6a73576c394b56bb589de640ed9f370213ed4ff1797f8cfba5fbab09f805b942792fdec73ce755490cd15990da91dd132cd4b12844e5d4db33f960f1
- SSDEEP 768:crv+4UNbdO3p+3qr4Aam6aQMGdjWca4Ghf9sxl:cbsbo3JSmaME6ps3
- TLSH T190F2AF31A868D9739CB79299F22B3643BEB451A3C9C40E84D8D96B0D439B4CE630BD17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 30KB
- SHA256 dd0a4fc2ad167fcd81a2d465aede5435a041114d95b0356ed43d027e5c20a144
- MD5 f3145f0f000815990bc386390a2a3e85
- SHA1 5862309de4e1f40859b564f290fd5a1b8be12f84
- SHA512 8444758bd2e889cfd074db38cac585b3a098f04803fa468837dada84dd98b47c7049c2b35a9b5e42ab4b2090af79ed190392191637917ebbd97a15a828fff10b
- SSDEEP 768:Zj+9k3jq3qr6Aam6aQMGdjWca4Ghf9sFc:E9k3jUmaME6pse
- TLSH T17AD29E316C689D779CA686D9F22B2643BDF042A389C81E84D8DD6F0D07D728E6307D1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 32KB
- SHA256 95b6a75ce6c646a4352e4364bf0955bd949975ddadb83982fd0547dcade1f658
- MD5 b59b51b1cc8b4cc1653d78982bf3883d
- SHA1 367ea1c197895fa9407f7402300998b926de650b
- SHA512 9ee534fa274e39d5c1a90f5d89ccffddf65fd115fee7f1c682b507ab3196c0cfa3cd23c23d9df8bc965555492c947f02e887025c0250ce134692e34a3b05990f
- SSDEEP 768:EF1j+953XwgEq3qZAam6aQMGdjWca4Ghf9sFc:J9536maME6pse
- TLSH T1B3E28D326C58C977ADA68BD9F72B3643BEF041A3C9C46E84D6CD6E0D029718D6307D1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 30KB
- SHA256 8fb11d34d5fd4297d66cf3d4ccc512c3d1ed9620e6f2eaae6f0ef9aec7a5e738
- MD5 f1919191b67a843aee6de1ff6194e889
- SHA1 a40bc7114d2f1c1c87e731f266e6bfdefd74c951
- SHA512 10fb96599d1f72f70c36f12bdcb170a640298c97daba7201cc9c9770fb95d7ed90b408ff97de04ff04e3e1420a917977ac05ccf3fcc76fa8dc480ea5930ed463
- SSDEEP 768:zj+9k3sq3qr6Aam6aQMGdjWca4Ghf9sFc:W9k3YUmaME6pse
- TLSH T1AAD29D316C689D779CA696D9F22B3643BDF042A389C81E84D8DD6F0D07D728E6307D1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 34KB
- SHA256 4d6806b3c3f693f7a1a7580188846965de89a80c12ff6e83ad0e96f7efd3b691
- MD5 2457e36d2a5f6f85a6a54cbbead5a0e8
- SHA1 9288b51116ffc26095f84794e999fdc50bcaba98
- SHA512 20f0efede69a9e35683d704c29ab074c655e041015e63bf74ee064b10c10c6103712dea0dd57125758597f842cfaa8dcd530d37c5559289a5593e4f69c7126ef
- SSDEEP 768:/rv+4UNbdq32wqGAAam6aQMGdjWca4GhfBjPeU/:/bsbc33KmaME6pbH
- TLSH T147F2BE31A8689973DDB79A99F21B6B43BEF421A389D40E80C9D91B0D43974CE3307D27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\859a8b96-e1f1-4d84-a4a1-61628361cb38.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512