Analysis
- user interaction
yes - max time kernel
5s - max time network
47s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
19/08/2026, 01:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DFIRThread.exe
Resource
win10ltsc2021-20260513-en
4 signatures
900 seconds
General
- Target DFIRThread.exe
- Size 541KB
- Sample260819-b89cpsvbkf
- SHA256 783f46dd6dce29e85e55f4d0a2315a76824cac825589be802857c6651cb63557
- MD5 93975fdb4b431fc48c202dc4f3d9f2f9
- SHA1 9752b99de642c27df3c0c2a4207b7bda78c66456
- SHA512 f9a9a23ac6727e626130a7aaca93dea185722aa3fcc5d438462ef9b946d58363c80f04799792ac8c1146daedaa47ec121e351d2a4718ba645928100e6d12b9df
- SSDEEP 6144:z06gRbaxxlmhvxUKNO4zgSJrU8saBcc1yULF3mU+rlIV7SC3FxqsWnrAGnOAtUJ6:zjA7QcUiQULcpIFSC37qsWnTnbtUQ
- TLSH T1AEC46C59A6A803F8D1B7C138CA524902FB727C564771DAEF03E045A64F27AE19F3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3308 msedge.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 DFIRThread.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz DFIRThread.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4272 DFIRThread.exe 4272 DFIRThread.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4272 DFIRThread.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DFIRThread.exe"C:\Users\Admin\AppData\Local\Temp\DFIRThread.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4272 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://127.0.0.1:8742/2⤵PID:2868
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x2fc,0x7ffe6bddc188,0x7ffe6bddc194,0x7ffe6bddc1a03⤵PID:4156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,15280475438713056027,18210031102960763455,262144 --field-trial-handle=2136,i,4196322328921018549,5359120759022251572,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:23⤵PID:1964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,14758116705271210697,11230076540111738014,524288 --field-trial-handle=2136,i,4196322328921018549,5359120759022251572,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:33⤵
- System Time Discovery
PID:3308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,5351859300483158117,14511127004307575614,524288 --field-trial-handle=2136,i,4196322328921018549,5359120759022251572,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:83⤵PID:1584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,2190292266159986995,14885708401396898276,2097152 --field-trial-handle=2136,i,4196322328921018549,5359120759022251572,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:13⤵PID:2796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,9799311999735059660,15160794724582119247,2097152 --field-trial-handle=2136,i,4196322328921018549,5359120759022251572,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:13⤵PID:1232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,8001342307734254861,3879167998110761585,2097152 --field-trial-handle=2136,i,4196322328921018549,5359120759022251572,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:13⤵PID:1544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,11039279207899064398,5558629451738997938,2097152 --field-trial-handle=2136,i,4196322328921018549,5359120759022251572,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:23⤵PID:3524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,14910629357005243264,5418171635635512172,524288 --field-trial-handle=2136,i,4196322328921018549,5359120759022251572,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:83⤵PID:2180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,15453260116656408342,2689293987425565141,524288 --field-trial-handle=2136,i,4196322328921018549,5359120759022251572,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:83⤵PID:2408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,12675650793958906557,6066053780534316955,524288 --field-trial-handle=2136,i,4196322328921018549,5359120759022251572,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:83⤵PID:4240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,14717494814008810189,11053462500014412784,524288 --field-trial-handle=2136,i,4196322328921018549,5359120759022251572,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:83⤵PID:5064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,10269857614834412642,6647830432345724219,524288 --field-trial-handle=2136,i,4196322328921018549,5359120759022251572,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:83⤵PID:4216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,10269857614834412642,6647830432345724219,524288 --field-trial-handle=2136,i,4196322328921018549,5359120759022251572,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:83⤵PID:4868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,13517395206929542361,16514070684450947118,524288 --field-trial-handle=2136,i,4196322328921018549,5359120759022251572,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:83⤵PID:2356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,14587805303935010564,9406015251861298401,524288 --field-trial-handle=2136,i,4196322328921018549,5359120759022251572,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:83⤵PID:936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,984179359009551234,9567705358785535092,524288 --field-trial-handle=2136,i,4196322328921018549,5359120759022251572,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:83⤵PID:2420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,8375168914624631634,10176646488007516819,524288 --field-trial-handle=2136,i,4196322328921018549,5359120759022251572,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:83⤵PID:1952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,17511903898389990886,4476862660744084994,524288 --field-trial-handle=2136,i,4196322328921018549,5359120759022251572,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:83⤵PID:4160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,1902559932804645590,1912507668476178342,524288 --field-trial-handle=2136,i,4196322328921018549,5359120759022251572,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:83⤵PID:552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,4075391860261451675,13774567231975065615,524288 --field-trial-handle=2136,i,4196322328921018549,5359120759022251572,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:83⤵PID:1052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,14956827646724802536,4592895026936492274,524288 --field-trial-handle=2136,i,4196322328921018549,5359120759022251572,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:83⤵PID:4552
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:2156
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 6a64f2ae6a6617d628aecf24522b5fc03d56fd3b87da29c09e359aa8c784278c
- MD5 319f3e9547ae8f5bd93b63a209353feb
- SHA1 2cbbe39cbb469d1b008a38a5f66950de62d7be5d
- SHA512 2335ad7dd232ded853c12042411a51f4c045d5ae5954aac7df9f840b69e4aee72129d3b0d5a528b94f8c84e50d9f92ecc1fcda50496c846e7b2b716f7e287127
- TLSH T115D080F777586105E75DD131EC13CB111B65195215D7DB02E314C99CA4644F566871C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 5c85913b3d3cab7ba2879d18441341b2b4fd7ad9ce12d0c3ebfe421e6267c647
- MD5 962c87a3f67f82f2083d6294250d9e58
- SHA1 cfe9fd1f6729400cde038cbdead8751b96eacaca
- SHA512 059eed3376b6b470a0be74a5db7d47fa3bae4b0557c4216789040d711e15417470e3ff6f96808c2e42bf6080c9af25da282ed4dabe378bd81b0971591713ef3b
- TLSH T11FD080F737586105EB5DD131EC13CB111B65195215D7DB03E314C99C94654F566871C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 f65766c759733d5e7015e2fcec2aa7183da4adb6055812f8d274c06684c9bf4f
- MD5 8b2076bb795ed9ad19f46a5354e24d13
- SHA1 686979f78fcfbccc8ba5f505ef25e75447017ca4
- SHA512 9a87da7f729a869ba66f283c5bd1a8f2454fa0e628efe71dcd2954f56b37443c21e5110621fbde065f71c198dbcbfa2691abe625320fddf193881fbaae807821
- TLSH T1FD71C4200F7EDEA1EFE2313995DED2D9F9FE850604571E77406054F66A07BFE0121A91
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585e48.TMP
- Size 3KB
- SHA256 97a89cc81f475dd943c6fb8b865b9771541651257f55b8ab1c0b58ab88c07481
- MD5 783061991e76c9cac17580a1294bc8cf
- SHA1 1b7d2307d6c7e770c57c5bf5c73d1cf9d6966be9
- SHA512 7e76c5392ee92dab41f4ceb63b236c665de6ce9743143142a892f3ff04608be05c78ab1007978e2d067f21f71f30bc24c16e8bf75f6b028c8d79276a50c00f97
- TLSH T17171C4200F7EDEA1EFD1303984DED2D9F9FE850604571EB740A054F66A07BFE0121A91
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 26ae2e4c2e0d06ee80c89d17a0e26b0d5c6de19dbdee4d7b5f9cafe43fb043a4
- MD5 a8f725d5ed8cbc48d75e25775e5e484c
- SHA1 7c5e31cf12ad21449cb0a0ac494ffc09d729c379
- SHA512 35627bafe8ff70b9c3491255ee66ac003ba3c6a8b44d5783faed8d45118bfa05ab757fcae7e8c7485ef730071ff2b8ef03a0f4b3a103116bb3248b896b85225f
- SSDEEP 192:sxZkRtyM/jK1Ml8MiD/fDsDmnbhFIdpdMHW6+WNXodD/YwwarlJIg4J:sxZkPqD/fDsDmbh2mHbXq/dc
- TLSH T10A52F911AA34A97BCCCBD30DFA55BF53D6F94463A2540D44ADFC8A1C04E6AED220782F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 35KB
- SHA256 46c28acc820700a891822ddba70ec1c76833e26ab9280bac8aac0ca3603029ea
- MD5 848ea7e398341ca9cc2c2a4c1a23b882
- SHA1 f653075f2f574d6c53e40e1cdb98e48b33081cf0
- SHA512 d44d61e647785caa39f808aacd7136c2b9cd49b2b3a5cd0a48dd85fc5bafa056c73856335b490d1ee02aabca2e3dc592000e0fcec85a16b03c905b01ad6d15dd
- SSDEEP 768:mf4TaKD7pLuLzyWWvyaZy8F1+UoAYDCx9Tuqh0VfUC9xbog/OV7rDhLlJX65droN:mf4TaK1EzyWWvyaZyu1jaWrDhLHq5Wu6
- TLSH T1DCF20B3B6C4CCB7E4F844E9CEC2A7F8A6EE8018B96D88D5447FA444C02C66EF51165DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 5KB
- SHA256 0f0937cc629f0eba3cd6ebaf928ff78063dc597c8d0a90ea5195de5317de1d4c
- MD5 1c429611fff4ad3b20bca8944c616812
- SHA1 62ba8d0ca390c13764c8c801b7b5832bde0af7f6
- SHA512 043653e483f52e797aa0dcba0691ef9a5dae4ea3c56ddb2609020ccb45d5026452f22c693674b5598cf57f6cd998579b03b7108025e637b1fdd82a53e03571ff
- SSDEEP 96:KsOeOROAOkOeOQOwOx7OEOrOsJOsOxKhO4JO+OxtOGOOOzOsOwOSK8gKV62qsAKY:mJIrXJ7bc36rvF4Qpih5yvbSP7n7XO
- TLSH T1E3C10713367A03412DBE2908A3A697374E4133777014FA6F7BE800A25957E612DFC9CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 18KB
- SHA256 074f2ac5c10cc940a533141486616bdc39991cfd0dc828bf2130eb3220ce1b04
- MD5 bc891426458ea61d3648930f3f8df783
- SHA1 da30d9f157088be248b4714ecc2bca208fd4fddd
- SHA512 ea481dd19da339b57ad4ab26fed6c8279b1321e211373de35f1c0cd208ca23e1c73940ca494795a36c6a0b0bfeffa7651756be388df38f5cce455350e9d5c41a
- SSDEEP 384:nDZcIhsNQklBnvJ+meFUiX1eRd8p1QiYZzTBuw:bhEyVJkd8p1NYZHBuw
- TLSH T1CF827DB0AC74AC364CEBE105F1CB32138F7854B79BC46F58D9E9A71D05C6694130A92A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 18KB
- SHA256 954d6abc3560f3f7593281c8845841baf061be497428d7ade51dda8413524ee0
- MD5 645419139c22c31181b2ff8efb6e8481
- SHA1 fdbd90e71b50c89cc3ac4515bc2ada181922150b
- SHA512 08d32cd52761d74dfbeaf49544ce7c07b4752d3d6535299313631da06265163dc3f518ef2154fdcb1414ae37672314193e42029bc4f0d57192016091371a8b59
- SSDEEP 384:ndZcIhsNQkWBnvJ+meFUiX1eRd8p1QiYZzTBuw:FhhyVJkd8p1NYZHBuw
- TLSH T156827DB0BC75AC364CEBF105F1CB32138F7894B79BC46F54D9E9A71E05C6698130A92A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 3a6c3908d04666fb23c789ba85f9b4a7829f0e1b902c7e9001df851ea75d39e6
- MD5 acc978a594e78591170c5215cba65828
- SHA1 46222ee13d8b0780a6c5fe79208d889a4bba238d
- SHA512 2c15a9dc3600906460d37ef67e2f8c529da780532e580f62b338fc32f94a52ec904704fe9f1311f0c9a8d0d48d5be51d6bbede5ba61348b66bda7eb66c480cae
- SSDEEP 192:mQJONR6zZU77QmiUypczmaU9X1daOwEcrIU6:m2ONR6t2txzmaU9X1oqRU6
- TLSH T19102F939A879A87A8EE3AD45B48B37135FE4102BDBD56F94CAE81B1C41D764C1303937
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 48553f138797be698337225ff4c04dd1eead330177368f1fee946e031d84834d
- MD5 385103954767d4ce8a7320f32f95c3f4
- SHA1 0d8022be47e23a6f7c67927fdc7b778f9309d179
- SHA512 cdd5766ee89303d679969a8f7d7accbd800838164ecb982423e0cd641a26f86dc5e20b77244888a78a0d5579cf6423e8ded3f68e62fa67a26ba593d371af2b9f
- SSDEEP 192:3ON56zZU+7QmiUyZcz3U9X1dEf5W61/s/FqJi1U6:3ON56tvt3z3U9X1eRdQp1U6
- TLSH T1C5120934B479EC364DD7B505F0C732539FA0207BDEC59FA8DAE81B1C06C7688270A926
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6a366e5e-5f1d-42a0-a711-ec201fef23f5.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 2e5a73706df763e8a6709be446b19c6e144655750799e4bc651d0ca7f8ea816a
- MD5 160d806f52b80691969b20fc335b9c06
- SHA1 0381e25f1ee0396aa486a2be90b4b656af762812
- SHA512 769f8aa190dfa4e0a8aeadce0b99eadcbdfb4373d1df55156b17625a547b9ebe508338142f2fbabd57124bc087a0571a320acca2ccd2c38d48e7c9fe9d596834
- TLSH T10F41F459B6F9115CB3B76E45ABF6A86D487AF8773E06D04D00010E4F0A62F00CDA1B37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\b1051d62-fe3d-481c-952a-df39e5fd1c43.tmp
- Size 1B
- SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
- MD5 5058f1af8388633f609cadb75a75dc9d
- SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
- SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2868_1692103292\CRX_INSTALL\content_new.js
- Size 10KB
- SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
- MD5 3de1e7d989c232fc1b58f4e32de15d64
- SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
- SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
- SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
- TLSH T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
- MD5 SHA1 SHA512 SSDEEP TLSH