Analysis
- user interaction
yes - max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/08/2026, 22:28
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://telateste51.uk/
Resource
win10v2004-20260513-en
11 signatures
150 seconds
General
- Target http://telateste51.uk/
- Sample260827-2drghsbb87
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2004 msedge.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134323433056809181" msedge.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{A2C4C1B8-0209-41EA-B810-A36985B4C42D} msedge.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 400 msedge.exe 400 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe - Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1112 wrote to memory of 1552 1112 msedge.exe 86 PID 1112 wrote to memory of 2004 1112 msedge.exe 87 PID 1112 wrote to memory of 4020 1112 msedge.exe 88 PID 1112 wrote to memory of 4020 1112 msedge.exe 88 PID 1112 wrote to memory of 4644 1112 msedge.exe 89 PID 1112 wrote to memory of 4644 1112 msedge.exe 89 PID 1112 wrote to memory of 4644 1112 msedge.exe 89 PID 1112 wrote to memory of 2452 1112 msedge.exe 90 PID 1112 wrote to memory of 4344 1112 msedge.exe 91 PID 1112 wrote to memory of 2452 1112 msedge.exe 90 PID 1112 wrote to memory of 2452 1112 msedge.exe 90 PID 1112 wrote to memory of 4344 1112 msedge.exe 91 PID 1112 wrote to memory of 4344 1112 msedge.exe 91 PID 1112 wrote to memory of 3904 1112 msedge.exe 93 PID 1112 wrote to memory of 4732 1112 msedge.exe 94 PID 1112 wrote to memory of 3904 1112 msedge.exe 93 PID 1112 wrote to memory of 3904 1112 msedge.exe 93 PID 1112 wrote to memory of 4732 1112 msedge.exe 94 PID 1112 wrote to memory of 4732 1112 msedge.exe 94 PID 1112 wrote to memory of 4164 1112 msedge.exe 99 PID 1112 wrote to memory of 4796 1112 msedge.exe 100 PID 1112 wrote to memory of 4164 1112 msedge.exe 99 PID 1112 wrote to memory of 4796 1112 msedge.exe 100 PID 1112 wrote to memory of 3008 1112 msedge.exe 102 PID 1112 wrote to memory of 8 1112 msedge.exe 108 PID 1112 wrote to memory of 8 1112 msedge.exe 108 PID 1112 wrote to memory of 8 1112 msedge.exe 108 PID 1112 wrote to memory of 4752 1112 msedge.exe 115 PID 1112 wrote to memory of 3376 1112 msedge.exe 116 PID 1112 wrote to memory of 1496 1112 msedge.exe 117 PID 1112 wrote to memory of 4848 1112 msedge.exe 119 PID 1112 wrote to memory of 4848 1112 msedge.exe 119 PID 1112 wrote to memory of 400 1112 msedge.exe 120
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://telateste51.uk/1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7fff9750c188,0x7fff9750c194,0x7fff9750c1a02⤵PID:1552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,12833325345509984310,16934450869820518373,524288 --field-trial-handle=2500,i,8502467540801208425,18439112190327609149,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:32⤵
- System Time Discovery
PID:2004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,5397181403753048265,11017429037585694172,524288 --field-trial-handle=2500,i,8502467540801208425,18439112190327609149,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:82⤵PID:4020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,2539875943890956725,4886593553280590595,262144 --field-trial-handle=2500,i,8502467540801208425,18439112190327609149,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:22⤵PID:4644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,13434938120308707261,4824332331567862050,2097152 --field-trial-handle=2500,i,8502467540801208425,18439112190327609149,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:12⤵PID:2452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,3415707030636823318,10325727919107010777,2097152 --field-trial-handle=2500,i,8502467540801208425,18439112190327609149,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:12⤵PID:4344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,7186733513034069377,3112302557212657903,2097152 --field-trial-handle=2500,i,8502467540801208425,18439112190327609149,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:12⤵PID:3904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,16443506854207184372,4993214563696690944,2097152 --field-trial-handle=2500,i,8502467540801208425,18439112190327609149,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:22⤵PID:4732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,11403035305555988841,7689535770966281306,524288 --field-trial-handle=2500,i,8502467540801208425,18439112190327609149,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:82⤵PID:4164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,15242779339492481462,6779425806707038241,524288 --field-trial-handle=2500,i,8502467540801208425,18439112190327609149,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:82⤵PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,14160396929773031706,7235207365232128246,524288 --field-trial-handle=2500,i,8502467540801208425,18439112190327609149,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:82⤵PID:2364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,14160396929773031706,7235207365232128246,524288 --field-trial-handle=2500,i,8502467540801208425,18439112190327609149,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:82⤵PID:3008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5944,i,9749435132228786483,14037557485910577301,2097152 --field-trial-handle=2500,i,8502467540801208425,18439112190327609149,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:12⤵PID:8
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,18396338981770523770,15518872668562041054,524288 --field-trial-handle=2500,i,8502467540801208425,18439112190327609149,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:82⤵PID:4752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,7257144036133789034,1658897297936341248,524288 --field-trial-handle=2500,i,8502467540801208425,18439112190327609149,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:82⤵PID:3376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,2841129263002639090,5272817288733060397,524288 --field-trial-handle=2500,i,8502467540801208425,18439112190327609149,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:82⤵PID:1496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,12303363801581032865,16388634871273316510,524288 --field-trial-handle=2500,i,8502467540801208425,18439112190327609149,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:82⤵PID:4848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5240,i,4678478265759219820,4833509984031786529,262144 --field-trial-handle=2500,i,8502467540801208425,18439112190327609149,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:2724
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9a35212a-14ee-462e-8243-a37a7218f4ba.tmp
- Size 522B
- SHA256 532e27b1c35cecf3833a063deb0a05850d18f45002890d4dd9c69509841b7738
- MD5 b809bb2b4dca57c6dcf6e141ab343c71
- SHA1 3d858fed3e81f1ca3d3c105aaa579c0359654edf
- SHA512 089d37cbd8d0d641052a8ffbbf4ee41489551f876cafb2dec05897f131d309580b9872e3493f6cec359efde76d766ef4a7f8ee86fa084740fbcbd049e7f749e6
- TLSH T177F0051380DA34D2EA6B00A0F1446DD4120FA1FA2919B7746975855681986716144736
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
- Size 105KB
- SHA256 f0ead82c3c8a4cd9959a8cd1cef74705c67e276b4a574243e75c890cb0b0b8fe
- MD5 f8a5a8774310485121aa8917052b352c
- SHA1 78542cc17bce16f7d0117a4beed6ae29c39c3042
- SHA512 94c06ac4086f7321e54c95657a2fc0769092ed3577572d27a9a75f404a57f6b0c02e9bb5c1e8c0c285a577d89a5801c60face4ebf1cee334d6be346c240f09ad
- SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
- TLSH T1D5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
- MD5 7060eae8ec426d15de2849b1f7d261b4
- SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
- SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
- TLSH T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
- MD5 dde9ea8dd9c7e315ef614ab3476af02c
- SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
- SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
- TLSH T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 c8479bde38651e5e164e4f23b000f8bbbc2afd86bd5d5d77fa469a1247d98dc6
- MD5 592660e5f5bcea6042fb0979484116b6
- SHA1 e9cb17e864a497a316cbf36cc9610a2fd2d67a15
- SHA512 3821e34754eb388f17490e5921553465442238aeca61a5a6567cc4b0c9b1a1cddfe4f1a8ea8f6c4587f982ea6ad93e8868166ffe328e7dff68663763806128ff
- TLSH T1778186390876A718F73263B2F4FE72F93172A2EDF1576D858140997C1402BA2C356E6C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 06a4a9b013fac7cb3256f84610ebc00d3ddc0da837216b77b7f389bb69601d1d
- MD5 49d1f791c9b4531ce3c9168c38ecbe9d
- SHA1 93d0d1cbd0b59c4db87a94caa764243b1ff1bb9b
- SHA512 c08bb1c9957bcc553be2d1d1a4aaa02cbbf6c6530d3a92cb1baab00833b863fad255c9def1b190732aafb9910504d7cdfad49ea330691d5c11e35ac055e03a32
- TLSH T1AE6180390D76E718F332637288FD62F930B2A2EDF1174C898144D87C1006BA0C79AE9C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 403fe5b303451058e23b528094f92f3cb34acbdd1f89b8c3477526259490594b
- MD5 75b3c92989ab30915d677fa076bd182a
- SHA1 38a0c1bf554a4d7707efc42ca76f79da0c905221
- SHA512 05efdff7ad27de591e0416e87282086e84723a2921b82bdb8af93f0ed6c9a485bedabdb60f2562a4850556498406740acf327b42a3b10737a952f57e40f96a01
- TLSH T1617180790976E318F732637284FD62F930B2A2EDF1174D858150D87C1406BA1C79AEAC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587c6e.TMP
- Size 3KB
- SHA256 3041cc9568a8a52f534ee50abafd089dd22f460ee5aefd6c02e4203fac57f74b
- MD5 84294026e6b2a24f83d60034b3ec5cda
- SHA1 f4ce5f0d908a0698354fc5aac8bd1a19ab49cd2c
- SHA512 dd746a73c67b3faf574a029596e2b6855b90d8a464ea1d82b3759e21f7f32882b3521a4eb30af03636e58f5eee1439477e0dafcb823dfe3e29219a2bf45376d4
- TLSH T10B6180390D76E318F332633288FD62F930B2A2EEF1574D898044D87C1006BA0C79AE9C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 e78b91308aa8ca35146edb68183baa33a486a1590556e268c3dd4eedb5e7156c
- MD5 65ab0006fd23fb53078c7ba4cf5a9d2d
- SHA1 e2cef2d87cacdaf400c316f3d4bc7d52698f4812
- SHA512 8d2dbcb4ef986a45cb50ca028d15569fc39aa6b76b91a6a3fbf8149ff68994e14a81f59f98a69f23b6f291e56d12c16cfea85c36d3c8cb2f78b4f1d8fbfc4943
- TLSH T1EB51CDF2D3E48A5D881152F0AB542F17DE1D0915A22C3E67C9E6FF9B93E20B1E111A4E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 12KB
- SHA256 25129a81d9ef763fb5a6d5647d85e9db9b032ebee3c2a5ff82b22a1db80185bf
- MD5 bed61b408719e704b3a7d1c8c177b34c
- SHA1 cd388bbfb6bc915cedbf843e57b255ba8da76afa
- SHA512 20729463d1b9285c8558f911ac6cb454ef6c2bad8c0b84516147bfb5ee28e194477b1b288952ee77f6bef5d7dd9b69886f89a3611abefd7eebe6e52129ff3c27
- SSDEEP 192:sxZkRWyM/jK1Ml8MkP/f/sXREVCIdpJHVS6+WNGYvxEUReIgrJ:sxZksMP/f/sXRoJHRGSA9
- TLSH T14C42E815AA386977CCCBD20DF941BF53D6F91472A2950E48A9FCDA1C04E6AED2207C1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 91590ddccab03c28213e11b47551304d79a65b7d75305103818271aa0b7a5423
- MD5 bb050450c0e9fb88690dd91c229a4737
- SHA1 010df7647d5fdab1d67c4ea86b3653aecfe2c1c9
- SHA512 b28b6c22f00f55f08615b5f7f7831fd07171b49afaaf30cba2557e09cdfa14da983a94260f2fdf53a0b562baf0357e3a8276b5de87b26ec110278d0973cd0cc3
- SSDEEP 192:sxZ7RWyM/jK1Ml8UQaikP/f/sxehmVCIdpI0HW6+WNJ/cZYvfjAReIg5Ya8J:sxZ7sqahP/f/sxehSJHbmZNA2ag
- TLSH T103520811AA386977CCCBD21DF941BF53D6F9147296950E48AAFCCA1C00E6BED220781F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 4e27c0b0fab898bd36f1d4211e70a58199790036f38bb60feadfebe48476600c
- MD5 89c96d5e2616e2ef0284a7a95c7be46d
- SHA1 d0b7616ffbf2a01a64e86e20250de2dc7b032a81
- SHA512 b7c5809dbc24e7eef08bf71bb4365daf5cc9472a7711a97af1ccdbc2e8d105ef82750ec2989192f9409dd11f346c4c393f7c26a4006175808ec3cb3d5da2e06e
- SSDEEP 192:sxZ7RWyM/jK1Ml8MkP/f/sxehmVCIdpK0HW6+WNJHT/YvkEUReIg5Ya8J:sxZ7sMP/f/sxehSfHbJ/JA2ag
- TLSH T15852F711AA386977CCCBD209F941BF53D6F9146296950E48AAFCDA1C04E6BDD2207C2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 09ffa51fd690b936a73c0eee1b2fc47a057d9da880ee5745c59a2004c37293b9
- MD5 c00a0580bcb775a76e1bd912ca8c457c
- SHA1 b425c43755b725ac7384a08a7b4178df8cf8f142
- SHA512 ee42b36c999ad332e96e98cfa72f3d10e58957d73badadf6e951d5af709028fda97b066e68fa7faa8f82258af3bc39a3e67942bce031a7d12d2a4cb2e00365f3
- SSDEEP 192:sxZ7RWyM/jK1Ml8MkP/f/sxen+VCIdpK0HW6+WNJHT/YvkEUReIg5Ya8J:sxZ7sMP/f/sxenKfHbJ/JA2ag
- TLSH T1B852F811AA386977CCCBD209F941BF53D6F9147296950E48AAFCCA1C04E6BDD2207C2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 30KB
- SHA256 4cfa01e9ede9e9b62771456ea72b1af65f2363abad36dc02d4503844281d469a
- MD5 596d13678409dc6d463c87bdfa5638e0
- SHA1 dce66bb4e20c50dc49418f9adedf0653f558b642
- SHA512 500a0b50c5a3227288f84147009dfa5d52409c8398e6194b7476a6fcb15e6fb76ae7f49bdcc8758ce38d79d3a35dc4cf2129c7258fc95e27772072be6cfbb76f
- SSDEEP 768:bHseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppAroHK:bHseJ3xWvhfynu1jaVcL88pLq
- TLSH T1BDD20B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA880C02C77EB51175DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 4KB
- SHA256 b8d1354eab99fb742ab08274ab852d0657eb347cf8007fb0c97ae5cf0fd2a0d4
- MD5 5f5b662c64087600f9fb03374f9c9776
- SHA1 5b40ee4d0a2809431173c5074eeca021d7ec6066
- SHA512 4e41c246db54473d43560d3b1cc62aa917963c8b3f217ba7d6ff2e67de76a5335cefbe1e91ddb4b9227c6c3833150275d923f3d7cdb0db4e0e8a9d13eeb9bd08
- SSDEEP 48:KYHIhKggkXyV7IlKIcg/ydfIlKwswCduJtL/j:KYH+KggmW7mKIcyGfKKwsM
- TLSH T1B1911F23353B02823C7D264CA3A7D53A4E4172A7745CB4AF7BB900A51E26E511DFC8ED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5918be.TMP
- Size 3KB
- SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
- MD5 904e6e94a1d46374c8630cfd86cc729f
- SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
- SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
- TLSH T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 12KB
- SHA256 eadc5a70f8ca60db47a937a42f6cb2f684a401c47a962cf8ac694b8efda318c0
- MD5 1535cb74bcfe8513304d3ebdb4fb3e7f
- SHA1 71b1da840c09c2bb8ec6b81fb4085bc940f49462
- SHA512 4d12fbb933575b2c47d23b1588f44a399afd163a8c510f48647d2e26270ad14d8b510df3796e1748bda5e2358b2b4bfce4ca00b1f103cca766a8b7c7ea7cab3a
- SSDEEP 192:u01LsNtyQtQgXV+M7hPTQmiU1GoGxX4MTXiSCaS0u48z1LqqTn:RpsNtyQtPlT7xF4Ip+uxlTn
- TLSH T172423A71AC789C7A99A3A581F44A33036FB4916B95C85F84EADD3F1C01DA29C130B917
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 23KB
- SHA256 4b270030804c53e45bece144b7c07df23e39db6426697cd948531cb983221c88
- MD5 19ffb528748ba46f161ebc58a42d5338
- SHA1 884c42dcc5e77fa680428e9ae3dfb1f4d26596ff
- SHA512 8304f58c720d0a6f88dba41b6d6907c00b51383ca042b6064391051628a0e61b6e0ff9906e51b42deb53fbc36abbc41e98a0514df4374c51a510794c811bf7a0
- SSDEEP 384:gGiFiZcIUsN38TUNTUlIl1p3PlT7x2TIp+uHlOk:gtFQU6wgHTCyTlOk
- TLSH T14DB21AF248D7883AD9AE5B43E77D2E034EBCD067B5859650B7D82A1CCC9617FC30A816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 15KB
- SHA256 095db703573dd31cd8c9058b5f69989d2beec9926005968882fdecfd1cdfd97d
- MD5 6f83a48fa7a0d854d0ec292b3af27e88
- SHA1 2fb244e01975e83b6cbbb5b0b6bbfb6468db4a98
- SHA512 99ecbbee7ef59bc49773a8af7a746b4c14a5fcd283dde70d38603f05400ed5cb3c4320afd6242ed8c0ecdcc9706336a9f377fa3c35faee55e85c0540886458b2
- SSDEEP 192:u51m+xasuheOwQxM1sNt1p3QgXV+M7hP6QmiU1GoGxX4MTXiSCaS0u48z1LqqOk:omZcI2sNt1p3PlT7x24Ip+uxlOk
- TLSH T101727DB1AC785C7AA9F7B591F48633031FB89027A6C85F84E5ED3F2D01DA698030B817
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 370e143facdb8597a505a6e79852a9b71090a40d9429b5e86dd2b6cfe8cc7734
- MD5 abd513db9a96db532e8e53a6d76e7dd5
- SHA1 3707db77901111a6dd71a5ab0a123b1fec1c09a5
- SHA512 08adc9926bd9fb8d9acd3c77973d4f2051d55f67babb457e1bff655c4a0a6e912f32b8d775be11abd911f945749b6893770b636dc8c6126d16c0c57c2bfe4ff8
- SSDEEP 192:lONB6vMtPQmiUyGdGWThTXiSCV847+sU/u:lONB6UtRVTa1/U/u
- TLSH T11202F835AC686C7BEAA7AE45F48A27172FB4207FA5905B50EAE82F1C00D765C1307D27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 9KB
- SHA256 d85497e2ed430d1b86e52a9cf0fad05f1fd2ac3f23ea4eebdeb59887fb1d24f0
- MD5 fabc795c6a52fa2482d1dca51b52d7b5
- SHA1 e09b20577f5f270ebdfa1b9eae03c254df91569a
- SHA512 7ec383ad2450eacdcbdf1d0f3fd870ba63983bbb486666ccbd5091a72ef653e22864d0508183cb73e8626a0a4fcdcada39167285cfc7d03b0a68bca3752433f3
- SSDEEP 192:oONg6vMBPQmiUyG/GW4hTXiSCaS0uA80ILqqU/u:oONg6UBRL4a+ullU/u
- TLSH T1FF120B75EC689C2BADA3B451F48A32171FB0916BDAC45B50E9DD3F2C01EB65C130B917
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
- Size 1KB
- SHA256 eb11a34656f4a08e145cea48a35441451df93161d43459ea64c8ad80e6e05444
- MD5 bbbcab6f3a81862b8cbe1f8d98378fcd
- SHA1 ac4c9e35f3bcfcf80ba8aad904ae10bd7a38cfa9
- SHA512 e0cd825e06edb6a0679fb0fdda5ee8999ee8e5931049200e5516a3913795e22409e92b94165cd1a8a7f7b7889d394b0a646a89bd89171b436aa9873d2cc39c2c
- TLSH T153415F131C0641C54CC0115D57F1DD71706FC54707354F0E5031E9D6D8FE94BE8674A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1~RFe58aa74.TMP
- Size 585B
- SHA256 5c4707051d097cc0f739bbcb337a7ddea0bcafe10cd41d4e236345797b70952d
- MD5 6262d5c85a2ac8841cd402eedd08d250
- SHA1 823c3621f804d017f2c945bd69c27de7e510ef2d
- SHA512 f03907edb5496710701f2a613bcbc0574424d1299c177ca0fd44544addf2843945a30c9640bbebff5c3686bb69d768cdc0badb17571b840e2622f818d6e6a5b2
- TLSH T181F0E1D1FD1F96A5E6DFF4BB5B3B44010C947E201812418965A88631DAF2B3ECDA50E7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 d06ba4407e81d063197d68d3122312fe48e6aebfaa632c3a3c1588e1ff00a181
- MD5 a48330c7fff7163d8991d804b6528957
- SHA1 4e393fd1bcb35a8326cd21f7c3279e5bc1c22981
- SHA512 a1a42f5ab6cf2a8569af88c2b27564d4f96c4c1d5c124947694aba4f3b8836854d81fadafee5b700258792a436c68ff64ce3ae11b1fdfa9550713a21cadde79c
- TLSH T149415B5CA6ED1048B3B37E56ABF7796E447BB9772E0AD49E10110D4F0A22B40C9B1B37
- MD5 SHA1 SHA512 TLSH