Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/08/2026, 02:44
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.kapwing.com
Resource
win10v2004-20260513-en
11 signatures
150 seconds
General
- Target http://www.kapwing.com
- Sample260817-c8mdlssvdv
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4500 msedge.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314083109771619" msedge.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{06D553AE-9DD1-4E7F-A844-6D89184C0C03} msedge.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4428 msedge.exe 4428 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe 1552 msedge.exe - Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 1552 wrote to memory of 4892 1552 msedge.exe 86 PID 1552 wrote to memory of 2060 1552 msedge.exe 87 PID 1552 wrote to memory of 2060 1552 msedge.exe 87 PID 1552 wrote to memory of 2060 1552 msedge.exe 87 PID 1552 wrote to memory of 4500 1552 msedge.exe 88 PID 1552 wrote to memory of 1700 1552 msedge.exe 89 PID 1552 wrote to memory of 1700 1552 msedge.exe 89 PID 1552 wrote to memory of 940 1552 msedge.exe 91 PID 1552 wrote to memory of 940 1552 msedge.exe 91 PID 1552 wrote to memory of 940 1552 msedge.exe 91 PID 1552 wrote to memory of 2764 1552 msedge.exe 90 PID 1552 wrote to memory of 2764 1552 msedge.exe 90 PID 1552 wrote to memory of 2764 1552 msedge.exe 90 PID 1552 wrote to memory of 464 1552 msedge.exe 92 PID 1552 wrote to memory of 2300 1552 msedge.exe 93 PID 1552 wrote to memory of 464 1552 msedge.exe 92 PID 1552 wrote to memory of 464 1552 msedge.exe 92 PID 1552 wrote to memory of 2300 1552 msedge.exe 93 PID 1552 wrote to memory of 2300 1552 msedge.exe 93 PID 1552 wrote to memory of 3856 1552 msedge.exe 97 PID 1552 wrote to memory of 3856 1552 msedge.exe 97 PID 1552 wrote to memory of 3856 1552 msedge.exe 97 PID 1552 wrote to memory of 3696 1552 msedge.exe 99 PID 1552 wrote to memory of 3380 1552 msedge.exe 100 PID 1552 wrote to memory of 3696 1552 msedge.exe 99 PID 1552 wrote to memory of 3172 1552 msedge.exe 101 PID 1552 wrote to memory of 3380 1552 msedge.exe 100 PID 1552 wrote to memory of 3172 1552 msedge.exe 101 PID 1552 wrote to memory of 1764 1552 msedge.exe 103 PID 1552 wrote to memory of 4384 1552 msedge.exe 112 PID 1552 wrote to memory of 5092 1552 msedge.exe 113 PID 1552 wrote to memory of 2676 1552 msedge.exe 114 PID 1552 wrote to memory of 3668 1552 msedge.exe 116 PID 1552 wrote to memory of 3668 1552 msedge.exe 116 PID 1552 wrote to memory of 4428 1552 msedge.exe 117
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.kapwing.com1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffd7390c188,0x7ffd7390c194,0x7ffd7390c1a02⤵PID:4892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,10268943160960047534,880337042078970656,262144 --field-trial-handle=2056,i,1430862491167776620,2184712112938497210,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:22⤵PID:2060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,13381512379980521054,3880203414465063505,524288 --field-trial-handle=2056,i,1430862491167776620,2184712112938497210,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:32⤵
- System Time Discovery
PID:4500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,14436956511540349258,5364572321005899499,524288 --field-trial-handle=2056,i,1430862491167776620,2184712112938497210,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:82⤵PID:1700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,13421349378064530512,14170173088666198738,2097152 --field-trial-handle=2056,i,1430862491167776620,2184712112938497210,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:12⤵PID:2764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,17821614354966032990,8149063759871151891,2097152 --field-trial-handle=2056,i,1430862491167776620,2184712112938497210,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:12⤵PID:940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,11439785283386154645,7713997872383257762,2097152 --field-trial-handle=2056,i,1430862491167776620,2184712112938497210,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:12⤵PID:464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,9452991297163987752,12970742958622323062,2097152 --field-trial-handle=2056,i,1430862491167776620,2184712112938497210,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:22⤵PID:2300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3940,i,13443238459981133412,9061832356565821327,2097152 --field-trial-handle=2056,i,1430862491167776620,2184712112938497210,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:12⤵PID:3856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3432,i,2067292676556116004,6609415873348855706,524288 --field-trial-handle=2056,i,1430862491167776620,2184712112938497210,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:82⤵PID:3696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,7180837722113594984,6897866320263357187,524288 --field-trial-handle=2056,i,1430862491167776620,2184712112938497210,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:82⤵PID:3380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3916,i,9921359041524748632,16293643588240864200,524288 --field-trial-handle=2056,i,1430862491167776620,2184712112938497210,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:82⤵PID:3172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,15020439401493361999,18367950899885614475,524288 --field-trial-handle=2056,i,1430862491167776620,2184712112938497210,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:82⤵PID:1760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,15020439401493361999,18367950899885614475,524288 --field-trial-handle=2056,i,1430862491167776620,2184712112938497210,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:82⤵PID:1764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,11549454841562905628,15968097289170396306,524288 --field-trial-handle=2056,i,1430862491167776620,2184712112938497210,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:82⤵PID:4384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,8233815247183382277,15269826876511357854,524288 --field-trial-handle=2056,i,1430862491167776620,2184712112938497210,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:82⤵PID:5092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,6831879418539960068,171923880200879739,524288 --field-trial-handle=2056,i,1430862491167776620,2184712112938497210,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:82⤵PID:2676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,14689569490032735013,93945065593276555,524288 --field-trial-handle=2056,i,1430862491167776620,2184712112938497210,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:82⤵PID:3668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6216,i,12703511503220362955,772569290804856253,262144 --field-trial-handle=2056,i,1430862491167776620,2184712112938497210,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:3248
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4fbef944-b1ed-42ad-9b43-ec5a7823f2ba.tmp
- Size 8KB
- SHA256 29d119d56bb0b5fd74a142d016b5a6061616a69855016ae492321887703f9f49
- MD5 9a038e51b414345a359f6480fe2a86c1
- SHA1 630ce43f6e83239009b7c07b578db05e7af5dd3b
- SHA512 beece1648f24edbbe0a769c907c909f36d0d7ce0f8f929a54d0aea2b2ea524b00efd069f36ea64d51ccc62fb65720fc145da13022b260ff513f87a97f74ea8ab
- SSDEEP 192:vONE61uWQmiUy5H0WGX5Obd+jFjzors1yRjAX6klpjJ2qEU6:vONE6XoUWGX5od+t8s1MAXLYU6
- TLSH T18B12FA32A468AC6B9ED2B955B48B31135EE5512BEB897F80D6EC1F1C01DF69C130AC27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
- Size 105KB
- SHA256 a8588cddb823d8d12f36aacd51b467c9ac59720ea10ba2810fd3447648877faf
- MD5 23f9fc30e5266ad705afe94b899001ad
- SHA1 85022ce11bae8e6f3918133c3247ff916e45e193
- SHA512 f8139a32ad10a0319290cd27df0fad7b701042560cc3f325c769b7babce6a80ef2c82fa5f0d0b578c732f18996029471f00f544cee16e1e15ea004f5b0ea459a
- SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
- TLSH T1FEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
- MD5 e3962be2eb3bd350a67bf6309159a1cc
- SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
- SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
- TLSH T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
- MD5 dd54db185d82309b854bfa7657ba4600
- SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
- SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
- TLSH T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
- Size 17KB
- SHA256 e450bb7e5632054414cd55b7a50ce115d69ef9944518f0b91e031057bac190a4
- MD5 6615918ab1257f42de1d5df5ac093397
- SHA1 46d9556230c81cd142d9ade91274ef2bc263f3f4
- SHA512 ea356949c898598eab4edc08bae233d8f55053b7411c4105bf1187494f8ff94a07beabdade22c3576f96c1f8c91a92b040cd81bd313a8144b9020dba90d83963
- SSDEEP 384:7EWav30hu67ASePya/zNbLsI1S5HvRYapeePMwV3LMmejKRHItM:7EWG2c2YNbISWHvRY+XVQPjg7
- TLSH T12682E0F4076A81DDF312B19A649A6187200E05EEE7588DE147920E2EE9F325BFC1F497
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
- Size 17KB
- SHA256 5c2aee09343f1786d17d468b1562ee4313b64d56db12c01b859493b81b2b35e3
- MD5 e30fc016bba16c1161e167022b609172
- SHA1 3b5c765c5a194426140303db75270c652dd14ef0
- SHA512 f718592b94e7842bc8a8d0ac6bbb6fc3c29a0ad228e36e90333c58e501bdf55d326659869ad82639ff8797fc69b38dc9a44845f936ccb00455c384ae9164daf3
- SSDEEP 384:e2mQYXEP8LzuiLqNXjYpHpl+js96PsGg3IMEELyvDy0E+JdR:wXEP8PuwB/LPH4QyvHdR
- TLSH T1E782BF85EFAEA246DE9AE609DC49B25CE2FC1D7728C2C9233D91530E8115C973B4D21F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
- Size 39KB
- SHA256 c1829c625739fa1e821758cb2c218f50ca2be8a84c31d9f89fb7216dec3502d1
- MD5 a66b0b16cdbb0add3147022c321362b4
- SHA1 f6262a137f71a0574c56a6e1faf2e8bb81f886e1
- SHA512 fd0627ce44583e213eec2c342a7b894c2b1ea51aff3db73c2b79858041bab19e9d38dea435cac7c5f623fe8b78536dd1bc3db2fff123c4f4b9a89e60cdc25b3f
- SSDEEP 768:VXNomphrVN9AaOQXESMF9PflosrEaBLOUKstE2fsH3U7b4ymh5U:VXvjVNe6ESi+qErGtE2UX245U
- TLSH T16503E186976CCA1BC26AC65A2CC4C85DE22138DD54B83807F63F0794A1DFA7673C635D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b6
- Size 38KB
- SHA256 55620d44b98c52bad0fdf6414e98627c8fd69f54a338a3222ca57362e04ea0ca
- MD5 09ef5eb672b31a9e92f53c016d596f99
- SHA1 b3073b7ab2dfa75926dcab0f321221fbaf357ca4
- SHA512 14a980dc3fced135c1674ecc7c9b3a99f44a5e8512dea4b8a2313b4cf6916b7aca285b4696bc0e49d9049d0d5957289d11397c4a290396be884d37085d696721
- SSDEEP 768:LK6DwFAbqNg9xnGqFHd7JTl2kYwH5VudHSj8A/twVyh184u0WStt:5DwAtLVd7JTMkRZQdHg8NM18fg
- TLSH T14103E13A9273DD6E462448A8876DB87A9301D91E08E775733B238FB7B005B233E4559E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b7
- Size 37KB
- SHA256 8bb5c73a188debff148e9ca4963b439b8ee841de41cd4fba9d9590eb990e8ac6
- MD5 845799e0a01b0b75a363f7f33f0aca00
- SHA1 cc67f1132adbb110813b4573194ca2084f0842ec
- SHA512 97100033021bfd5712249c303f1619968adf7ae25e3a5b498657e3faea058689bcb46572799b323a7bf922c79cf40200973d5f99079e4eefe9001d839fe92142
- SSDEEP 768:bvSS6XInSH/pIKhb88mboZUbPws3KzaH0ElD2MSHH:P64niIKtDmkZYP3KS0AD2MSHH
- TLSH T13E030245F916CA30D11EA514A2AA5F39711F8210D26BEEC3A7CEC6449F9FE6C0E8D681
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ba
- Size 22KB
- SHA256 b6ff367d4b4e87011bcad15b0acc43a3f1dcd3ec63872c9767325330619483ca
- MD5 6b55636ee048e67defdaabc4ef88b37e
- SHA1 dc557f1b650ed075dee786c5dcef11be986410cd
- SHA512 8144190103335de6452b73bfe990f15dcfaff10a5b7d1277618096b90c5bae9d35bd063d8a9eaf3a28d170810f464f30cd2f4d80c757582a3982e48411e7bf3c
- SSDEEP 384:1fnBip6GBqhn4I6PkDk+HtKD/zdJQrGQVLc6OL/oZg6W3o6QQSRhCtddvkyfotxt:VnQo14IDDk+Htozv1+LO+O5H7vjfi
- TLSH T1BEB2E13E6A5971FF2184CDC3B441F15A5BCABC82E91C2986878828F0BB94F56DF4E065
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 4KB
- SHA256 f85935468a5a5a8bdd92da5dbdf7de5d1f8f6041f84f584be852e04f0d06c538
- MD5 04a413843492061c6f563fe3459eee5a
- SHA1 cfa351fb59ce25f991bd07077365787f99be0ccc
- SHA512 cbc3e11cbe92d85a88dbeb80fde879a707981fa4af96da578584b641087eed86b6a636ec82b8f1bccf861d8dadcc13b75441aaa7d936caa9f7595e7f7ab44573
- SSDEEP 48:PnVyAklt3P3Sw/kpvVYK79QkA0WwtkFxVT+3xIIssod3HyHd:vgAeP3SIkpiK7KkAOKH+hIIPmy9
- TLSH T10B914F9804F64182EB58DA3DDAA18E06353040AFDB937F5B21500F7F7883FA28A1BD1C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 bf6d1c76f1cd2ad1fa6caed30f6a87501b4223e40fe879ec44c10afc699a50c3
- MD5 5561b217c0eb55518be8f3bb36626d43
- SHA1 75b23e859761e6511ced681dd341cd71890842dd
- SHA512 755e12d1cab0bac5bc424e306ed6bd1c983275cbb01d062c911f23c6c42df942aca8ec8766e0b2b50a59cd07df00649ac1c748508e0458e1ea3f8849637715f9
- TLSH T1AF718FFBC3E89A2DC84251F46B246E2FCE6D0D2447183C26C8D5AF1BA3D6571D14465F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 cb11d002190beef292cb61707b8c27f54f41eb1b6c032292c6fa3c9e3a1201b8
- MD5 1ef952bcff2888267bab1fe858522ed3
- SHA1 90cc37697bd5b2119914ee46f558d5b3c436b341
- SHA512 8b6440fe40b151f01479bb85e6277147e7fc37d13f85d8e9a051fdf5da6110d368e60466842e90ee52319cb381bc3c769ba2324f33f6ceb4ac777b288cce43e3
- SSDEEP 192:sxZ9z/yM/jK1Ml8Mkh/fmsvcyIdpmbdHW6+WN94B/YHFW+8p9IgrJ:sxZ9z7Mh/fmsvc76Hb6/vph9
- TLSH T15652E916AA345977CCCFD209FA557B53D6F51962A2940E44AEFC8A1C04E6BED2203C1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 5f0d7bde74a0293433ad97722543a24226f54513a68aafdc9990ced926fc2753
- MD5 0f5fe3b85ad36fb394c86fe2b871d336
- SHA1 7fc43255cac4254a33bad69fd8e7001458ea7101
- SHA512 10afd948830ff15d361ad5fe6661b19b5189a18433bf8dd07cddf45097a249dd77cbe5a363987e98bb88e8bd0703e5912db5f5cf22eeffb1bbc89f13d9f8cc42
- SSDEEP 192:sxZ9z/yM/jK1Ml8UQWkh/fmsPGyIdpUbdHW6+WN9lthYH6R+8p9Ig5GJ:sxZ9z7q9h/fmsPG7YHbNhxphs
- TLSH T11E52E816AA345A77CCCBD20DFA557F53E6F5196292900E44AEFC8A1C01E6BED220381F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 30KB
- SHA256 bd0834bad7ca548e115150e5117ac3468420291e0e4912bef1b80d5f6849fbdb
- MD5 175087466e234a62f1b05a010c00df83
- SHA1 2bc75da0fb51cb638327aa7664a29b7372698fae
- SHA512 b15683d53e209fbe19895fcb7b8cdd01089be0b9f438d8db26dfcc39dc9f08aabf532f06e88a6aee35c81b15d954944d5a3d65e4000a0bf4822393f90a79afa1
- SSDEEP 768:lUUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RmroVG02:lUUZYTMWvg0Pou1ja7eLZmRdz2
- TLSH T154D20A3B284CCB7E4F844E9DEC266F967ED801CB5A984D5447EA894C03CB3EB112759B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 4KB
- SHA256 e6fc50f5fa9ed6bdfef4056c3ad05e904c532175e76ec3010f5dc62851bfb6cc
- MD5 6aaeb6a4a59c2ce89c7a4aad8b410925
- SHA1 fafa7ca50b5ae6e1eba22d951f41816f1d897601
- SHA512 6fba4a25b4d31ef4765d4ca14e16bc2ab23b982cc585630266228801b4358dd84342ce4f68a1d5e613b8b5a622872a37687a8fc1013485a4fdede12ebf4b4392
- SSDEEP 24:Kdsfj45a2dOuq4GC+ZIjkqKiZha6q1EUWf5qra4dsYU4M4+fIjuUKiXhaYU1E2EV:KA1ItK2AITINKUUobyVDIVKUsw89ItKg
- TLSH T1CD9116A271BA07053C3E2A1C8294975FEE4172533118A46B7BAC41B18E6BE315DFDCCD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\64dd6d75-3c03-4e3c-bb16-8a2b38b1c418.tmp
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 20KB
- SHA256 6a65eb4e3671b40625bbced3eb6f6178272bce6d732c30d6fe7ef8dc68a422a1
- MD5 281eafc7d654d6ba4d5511f533c4edb8
- SHA1 bc94d2fb040b2d91e2dc078f2ea43ac81479ae35
- SHA512 2736c7a1ce1c023ee92981e32d45ab0e433251f4a67c485131bdaf95e767b8b27127b3883ede330477ff7b2a3436c8fac2e8e35a6bbf19e58999062cd7fc455a
- SSDEEP 384:aZcIhsN5UjdMrUTHKzX5od+t8s1MAXoYOOPrXLpe8C/J:YhJ2gHeOsPoYOi9P+
- TLSH T11B928D31A4786D675DF6FA85F98632039EF89527F6C46F8492EC9B0C05DA5A8030BC37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 27KB
- SHA256 43ae7ea9cd62ef575063023ade8f09f23d1db77e2e6d606727915db25621c81a
- MD5 df3b68ebcf0f049ebc49f5f9d8f94b5d
- SHA1 5083f12af7335c33b662ee1994c18e56eedbacff
- SHA512 70b4cccb4ebf3b4f8f46864aa0c0d27cd7ed0596521b0422cae8883f4c106d68aef101a7c7c79a04f5fa25c44fb954c92f674f979f27bac91626c45e00b9d05a
- SSDEEP 384:piFiZcIUsNb8TUNTUlIltjdMrUTkKzX5od+t8s1MAX8YOOPrXLpe8C/J:AFQUWwgr2gkeOsP8YOi9P+
- TLSH T17CD22AF294DB9936D9AEAB43A77D2D025EBCC157F5846A40B3D85A0CCD861BFC306C21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 236da2e3903197620cf031f31bbd1df0b22eb3009157b3f2a6f011e56271e4c4
- MD5 b613151593dcf89ac37d4174b03b2f6f
- SHA1 fb1b24ee4c9f93d8773e393a949249c54cfe18f1
- SHA512 d05113e6293832b5e5cb7cedefd2b172a65a46ebdfee51e3155a7a7ba847f9b4599ea91a4053e82a22cc23354941967d355d08fbbf353449739710522bb97093
- SSDEEP 192:yONx61VWQmiUyC0gGX5Obd+jFjzors1yRjL/ai3YtU6:yONx6WAgGX5od+t8s1MultU6
- TLSH T1D402D836A9686CBB8EE2BE45B48737135FD4206BEA556F84D6EC1F1C00D765C2306837
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 20KB
- SHA256 68851123eeffc93475392b076b250ae7714faf92e5a1bfe4fc582b804b158c4c
- MD5 35924eab63a9c65970faf2f518a9f88c
- SHA1 6ef006e3ccdaf99d6a4f16f446a449e93166a440
- SHA512 9492818d09a257cec25049975cd14c2782281c8405c2194d1f3ec0f2820f1b6687b404ed71fcceb779cc816518bb3979ddf86cd8f6b0ecc8691dc84661785f8a
- SSDEEP 384:FZcIhsN5tjdMrUTHKzX5od+t8s1MAXoYOOPrXLpe8C/J:9hm2gHeOsPoYOi9P+
- TLSH T178928D31A4386D675DF6FA85F94632039EF89527F6C46F8492EC9B0D05DA5A8030BC37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ded19979-800e-4141-831a-5b73053722b7.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 fbeddbc8fdf8161da2eab9239b5921a3f421ef91648530e15bf5800be79dbc22
- MD5 fb5bb03c36a6b4a3bb9c361f136b3096
- SHA1 08a62f098ec40b5a16dd64236869747b076453cb
- SHA512 328ecb4a0084fc18bd87682642af97e38539539fbfa4ff9f1793eda4d12f8a73f4e01a17c2544ba8fff82a37ba1e0446f6cdc31af74802e656f77055a5734eb8
- TLSH T1CA412B58B6E91148B3B77E569BF6A86D587FB8372E07C09D10010E4F0A62740C871737
- MD5 SHA1 SHA512 TLSH