Analysis
- user interaction
yes - max time kernel
148s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/08/2026, 13:05
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://ziggo.nl
Resource
win10v2004-20260513-en
11 signatures
150 seconds
General
- Target http://ziggo.nl
- Sample260827-qbj4waveqa
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 5016 msedge.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134323095200759255" msedge.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{D5FDFC57-B6F3-4D61-8EBA-6D26B09E0581} msedge.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3776 msedge.exe 3776 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 4736 wrote to memory of 4284 4736 msedge.exe 88 PID 4736 wrote to memory of 5016 4736 msedge.exe 89 PID 4736 wrote to memory of 3156 4736 msedge.exe 90 PID 4736 wrote to memory of 3156 4736 msedge.exe 90 PID 4736 wrote to memory of 2956 4736 msedge.exe 91 PID 4736 wrote to memory of 2956 4736 msedge.exe 91 PID 4736 wrote to memory of 2956 4736 msedge.exe 91 PID 4736 wrote to memory of 2364 4736 msedge.exe 93 PID 4736 wrote to memory of 4792 4736 msedge.exe 94 PID 4736 wrote to memory of 2364 4736 msedge.exe 93 PID 4736 wrote to memory of 2364 4736 msedge.exe 93 PID 4736 wrote to memory of 4792 4736 msedge.exe 94 PID 4736 wrote to memory of 4792 4736 msedge.exe 94 PID 4736 wrote to memory of 3380 4736 msedge.exe 95 PID 4736 wrote to memory of 4224 4736 msedge.exe 96 PID 4736 wrote to memory of 3380 4736 msedge.exe 95 PID 4736 wrote to memory of 3380 4736 msedge.exe 95 PID 4736 wrote to memory of 4224 4736 msedge.exe 96 PID 4736 wrote to memory of 4224 4736 msedge.exe 96 PID 4736 wrote to memory of 3012 4736 msedge.exe 99 PID 4736 wrote to memory of 3012 4736 msedge.exe 99 PID 4736 wrote to memory of 3012 4736 msedge.exe 99 PID 4736 wrote to memory of 2572 4736 msedge.exe 100 PID 4736 wrote to memory of 2572 4736 msedge.exe 100 PID 4736 wrote to memory of 1688 4736 msedge.exe 101 PID 4736 wrote to memory of 1688 4736 msedge.exe 101 PID 4736 wrote to memory of 4528 4736 msedge.exe 102 PID 4736 wrote to memory of 4528 4736 msedge.exe 102 PID 4736 wrote to memory of 4528 4736 msedge.exe 102 PID 4736 wrote to memory of 3136 4736 msedge.exe 104 PID 4736 wrote to memory of 1616 4736 msedge.exe 107 PID 4736 wrote to memory of 4336 4736 msedge.exe 108 PID 4736 wrote to memory of 4744 4736 msedge.exe 109 PID 4736 wrote to memory of 740 4736 msedge.exe 117 PID 4736 wrote to memory of 740 4736 msedge.exe 117 PID 4736 wrote to memory of 4892 4736 msedge.exe 118 PID 4736 wrote to memory of 4892 4736 msedge.exe 118 PID 4736 wrote to memory of 3776 4736 msedge.exe 119
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ziggo.nl1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffef3b2c188,0x7ffef3b2c194,0x7ffef3b2c1a02⤵PID:4284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,6789467549274196511,4419416931349734597,524288 --field-trial-handle=2456,i,10199728028070188711,10318340660128456299,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:32⤵
- System Time Discovery
PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,15374902895589900215,11404260140294542885,524288 --field-trial-handle=2456,i,10199728028070188711,10318340660128456299,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:82⤵PID:3156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,7817238449740340078,11871851734498846175,262144 --field-trial-handle=2456,i,10199728028070188711,10318340660128456299,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:22⤵PID:2956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,9862162035444962257,1670174681954000226,2097152 --field-trial-handle=2456,i,10199728028070188711,10318340660128456299,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:12⤵PID:2364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,16028758496520615369,981927796073484548,2097152 --field-trial-handle=2456,i,10199728028070188711,10318340660128456299,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:12⤵PID:4792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,15748347831249183509,769478925652847006,2097152 --field-trial-handle=2456,i,10199728028070188711,10318340660128456299,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:22⤵PID:3380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,11764279769430258836,12798246087150747055,2097152 --field-trial-handle=2456,i,10199728028070188711,10318340660128456299,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:12⤵PID:4224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3548,i,18344062785852154144,6644756831614449325,2097152 --field-trial-handle=2456,i,10199728028070188711,10318340660128456299,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:12⤵PID:3012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,6649918694986790946,8573692715622629679,524288 --field-trial-handle=2456,i,10199728028070188711,10318340660128456299,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:82⤵PID:2572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,16724776790031956664,16808721387846073189,524288 --field-trial-handle=2456,i,10199728028070188711,10318340660128456299,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:82⤵PID:1688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5632,i,16330633817499942929,2875742268714542317,2097152 --field-trial-handle=2456,i,10199728028070188711,10318340660128456299,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:12⤵PID:4528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,3842729604992521294,2165504858420661725,524288 --field-trial-handle=2456,i,10199728028070188711,10318340660128456299,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:82⤵PID:820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,3842729604992521294,2165504858420661725,524288 --field-trial-handle=2456,i,10199728028070188711,10318340660128456299,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:82⤵PID:3136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,16530803580399672951,9687481039224859811,524288 --field-trial-handle=2456,i,10199728028070188711,10318340660128456299,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:82⤵PID:1616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,3625160640703342486,15503003295305543880,524288 --field-trial-handle=2456,i,10199728028070188711,10318340660128456299,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:82⤵PID:4336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,188457122535585661,11268339932615891169,524288 --field-trial-handle=2456,i,10199728028070188711,10318340660128456299,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:82⤵PID:4744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,17665034450801948757,6251455420397369246,524288 --field-trial-handle=2456,i,10199728028070188711,10318340660128456299,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:82⤵PID:740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,5645225133455329739,789386542862646376,524288 --field-trial-handle=2456,i,10199728028070188711,10318340660128456299,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:82⤵PID:4892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=560,i,15140565198822355735,2287547348295724539,262144 --field-trial-handle=2456,i,10199728028070188711,10318340660128456299,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:4548
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
- Size 105KB
- SHA256 2bc7f3a4024d9673a2f7a098d546fe1f592a8aa0477eb259121fe80954c2f99d
- MD5 403039b77d88ae3c8e79a108e60c95e6
- SHA1 478b6a90cbd5967be9b36c911b5a2135e0b7199c
- SHA512 fbec8c6863e6042041cea05b5efa69ca53b0340f3bee0900ef55602e442dca5b20c736b16589ad755fc44c45bb2c920ed0e29957fb7ab74fe05e101f104c82fb
- SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7I:fwUQC5VwBIiElEd2K57P7I
- TLSH T1EEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
- Size 16KB
- SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
- MD5 3406d3b708dcef0116bffd8eaa181ad4
- SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
- SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
- SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
- TLSH T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
- MD5 56d82099872fb501c566d072ae897035
- SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
- SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
- TLSH T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
- MD5 f19ec2293392af872f10929c41627e26
- SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
- SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
- TLSH T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 4KB
- SHA256 dbcf743670085c0a7d485233d67d0c8f802477da410b475a9431a309b44ab2b3
- MD5 6344d6dd80861595fd949851012f5cad
- SHA1 dd47ee4ea54c31d7e49609a4b992074cb605d6cf
- SHA512 59f94a4764949fe455634f6e127db857f36f6206b319d83927cd4399a3cb9c8df9518eac35a621e0dbf8b68b0eea618f31fe5b424725d229f7053aa4e08a1202
- SSDEEP 96:2Lpyv6nWS6GvvCSg56HALB2BotIpmfEvugE3EOMu:Qpyv6WqvO56ggmCpGEe0Y
- TLSH T199817037A2494815D76029B0D8D89B80F6BDEC9C5AC73E6E0C504DFEB829B57B302C89
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 4KB
- SHA256 9b0ca2c845c7c4399335934df390230c7c22d0e7f997f440109382e492485ccf
- MD5 a49229f4d961801051f5bf057ce84c1b
- SHA1 b80c5d2c3936bd3e115981e55b7f4da322855689
- SHA512 84ffce4aef9db7322a86abe19c95fe40d4398ec9ded7b2a8795d2b3bd9e89dc863663d85e2101622a28ca505dd10e397f8aaab1ea43b3ceaa7c951d8855a8e0b
- SSDEEP 96:kpyv6nWS6GvvCSg56HALB2BotIpmfEAlmugE3EOMn:kpyv6WqvO56ggmCpGEAlf0V
- TLSH T1A3817037A1494815D76029B0D8D89B80F6BDEC9C6EC73E6E0C504DFEB829757B302C89
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e4cd.TMP
- Size 3KB
- SHA256 87a19565b97ece9d158fec00e2c134ef904d1dd13d406b2009752830935d462c
- MD5 356c1c9d6c2153c511e7086100f26dd2
- SHA1 198bee89aa139fe7bb67f4e7c30eba5e6f6b59ad
- SHA512 a32e7371fb6457ed3d68e7e8735369a706f0fc16b4642a8f80be97e70a29d2e3991b68cc81d56ab07695afaace67a702885b4eb99e45ebf6ffbece56957dd202
- TLSH T1D571293726424952D34020B1E8A91741F6BECC9D8DCB7E6A1E904DFEF919B47B306CC8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 111B
- SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
- MD5 807419ca9a4734feaf8d8563a003b048
- SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
- SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
- TLSH T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 b047c46971faf12b38bfca6d08c54955708d63f07dcbf95409adf849bd27b58c
- MD5 c9ae21aac7564afc575d3e899529d452
- SHA1 cc077090481c5fec162e59f487474cb648b226bc
- SHA512 cca8953ddf4594d879df1dc980f86bd7bb7cfa65faf090b790195bc32e3e1e87a7d172b7adbb4b21462dd146652ec64c63c8f41560ebfab537465d2dc7fc7c0d
- TLSH T1B28177FB83E5866FC92193F0AA147E17DE6D0556426C3C0985D4BE2B93F28B1F241B4E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 12KB
- SHA256 6fa1481d222c5aa7b0164a7b534ba7a38787c9daa0035a4a531ebfba69251f0d
- MD5 0cb3de06bd8f3d13e00bc6262f6c7abe
- SHA1 5dad5c82aa8f1c6cdaa2ce25ad189432043e04a2
- SHA512 03b1e4a021180bed30c458f0d958067c2c03bb595577ff902642658b73e720fccb1f15b439b3b0f4dc7941b07a551e0a47a98d27a93953e8626f7cbe0b05b8ed
- SSDEEP 192:sxZERKyM/jK1Ml8Mkv/f2seBQFIdpf1HW6+WNT9d/YwBurNIgrJ:sxZEAMv/f2seBQ29HbL/u9
- TLSH T1BB52F9016A34A97BCCDBD219FA51BB53D6F5147292900E44AAFCDA0C04E6BEC221782F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 bc271ac101397802fce2339998f70e7340c2cc1e6f511bb50875c34348b25548
- MD5 91a5fbe49c91d46535eacff88557cab8
- SHA1 9359eb3ae489b3632876e7a5e1e69fc6f54cbb6d
- SHA512 88252ede1ec904c05f15584551740eeecacc1b861424c6165965630039af64d9ff7a60484ba8b977f6efe313a6bfc15a22231b266760d743fda14c62b433b270
- SSDEEP 192:sxZ5RKyM/jK1Ml8UQ0kv/f2sEBRFIYIEpp1HW6+WNT9d/YwP7HNIg5CzJ:sxZ5AqPv/f2sEBR9bbHbL/78l
- TLSH T1DE52F711AA349977CCDBD21AFA41BF93D6F5147291900E44AAFCDA1C04E7BED221782F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 6613fbce07f541e67c63cb47a5c21f855712a077884cbc512983acdc8af1538f
- MD5 5d43c01126f93d1edb67030776e631dd
- SHA1 3ed323ce07e948d2aee2f06817a740785574d4ac
- SHA512 47df6fc26c53d47f68af183883f75245227e251feac3dcdc6cf42d809bbfc1de1ced1591f86532207dcf9b17ad6fffd887238e6e0dc96680bb21110831fa3c13
- SSDEEP 192:sxZ5RKyM/jK1Ml8Mkv/f2sEBQFIYIEpf1HW6+WNT9d/YwBurNIg5EzJ:sxZ5AMv/f2sEBQ9b9HbL/uyl
- TLSH T1BB520A01AA34597BCCCBD319FA41BB53D6F5147292900E44AAFCDA0C04E7BDD221782F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 30KB
- SHA256 ea8d94015472ece108c7759c7a92accbb0a76b3127d1201ae306b58dd0130bb2
- MD5 d3036ba8b589ede6c55e4b88c808ba80
- SHA1 6b40b54250ade67a9a1be750087307647a234800
- SHA512 4d2b8db09160da44035aac215d335c2c65b2bcdc8082447c7f8cdc483185694b0183fbbede888155bbea0dad1eb9fb1feffc46ff09eaaf48f52ea53175d49096
- SSDEEP 768:c54jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dLrohicHBah:c54jeXmWvmKLEu1jacPLZQd4LM
- TLSH T1C1D20A3B240CCF7E4F844E5CED26AE976ED801CB6A584D5447FA894C03CB6EB512B49B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 72B
- SHA256 8b55e42440b9848df11c33e1bab525c8f769c708871189adeaf73baa0462aeca
- MD5 a3150cadb1db8edbbbab87f154de931d
- SHA1 d5a1a2130b370c0bd1aebd91dda4ea1ec64fdf54
- SHA512 9eb52f482c57b4c3a5902f12cea5da728ac90530a5ff9ecbb8df190b191e6092d21a142827def47a07f53a8bbd6cf7227bb6f4d8b28800f77f430c13b2531e64
- TLSH T1B7A0029181971041E15586F19851428C77304A109386232599E4545488902944736505
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d0d8.TMP
- Size 48B
- SHA256 67028661ac0b2233bbb9b2f01b012d45e94bf5d1e79bcea539021f4c38d436b6
- MD5 a814723a5c2845aa0611995b546f815a
- SHA1 7dd1ace03543b68aaf7f93820c0d6537016dd425
- SHA512 56e913f0d5359ac19427548b31fb688aa9d09b7134b98fd0951feb1ac951e6149753b6ae0f1e5d5bc3f578539dc7964747773a7a771d5b5c8fdbcfbba2e82e66
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 4KB
- SHA256 ae095b2101d813af871dcbe63983d554c6383cb192953d43fa5077bf6b38422a
- MD5 52b9be7088b7a1633ba774f963a04397
- SHA1 6a6319c12dbdce4f350be5ac45c467d29d444e8c
- SHA512 1594d8cc8ac098840c8e0f8a382eba273954f7ee6671c748269164691691ecb658d3fd7c50ad652be08ab33b0a50942137c08cd61b0cab3493832c1e6d887c40
- SSDEEP 96:KPYDMoGi+cmypHUwcKsJUecI4oJ24Bp65OaQwgSmdcWUx/KsuUP/ILDUt652KC8z:UlX0VO
- TLSH T12E9112153AFA02022D3E3A1C91D49B279B4671A3325DE52B3BAC25B24E67E144CFC9CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\acb5ca8b-58b3-40d8-99a7-1d00b1e071fc.tmp
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 18KB
- SHA256 0514df62e1c4dc9fa82a5c9be64e98abc0f7b8b9383c69fa8a85dcc790deda73
- MD5 51d55cd05820c09d16f4f95577a014db
- SHA1 8a6808baa2173f828db0196d1150110952c90f1f
- SHA512 23e6edfe5b875ac1aa858cd4f5f4de3e880debfda4835c7e9cd35da6d5dd7c20e464c92d0042fa2d6170c8570387cd781deb3a42c02aa5ed9db1fcc17cc13d98
- SSDEEP 384:gZcIhsN/s1MB+tUCf+682IXe/FA+HBbsFgJ5oZ:eh0KGcAgF5W
- TLSH T150829E369878AC7759E2D252F05736134FF8816B97C86F80E5EC7B1D04CA6A9130BC27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 72557c8c5b86b54f638d7a76a506ee2c81d939eb10b9f930a06468d6dc3f9bda
- MD5 be3afd83b6a5263e6e610531d045f982
- SHA1 80492cb4f53af85313793560709d5aa398092166
- SHA512 709d825ab918c87b5e2334680f30a90acf68303eb524aa74feac7cf524f5f6ab405ea3430d5524a0ab1c05a6037aa889537c666c20b9425925e409236e283a59
- SSDEEP 192:EONQ6hZ0QmiUyeApc/+jV0jzor2e5wOZgdlU6:EONQ6oSpu+682t2wlU6
- TLSH T16102D935A8787C7B8EE2AE45F48737235FE5116BA9956B84DAE85B1C00C769C2307832
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 26KB
- SHA256 aed9bbbefb5ba460e36dae1ed2d4137958d139a02cd9b03afb33386ae5c330a8
- MD5 44524c8bb8fb3cf68e34ea8fe44a4b33
- SHA1 dc959965a0139158c55250d86e9551e926b6f1ff
- SHA512 813e09e6b197a540c6e322bfa15ec6c2574e28a66c88cab6e27475701d4c42d384cd59e159a039a3c1b7a62700104b010bb08416f1c4f6bac9c1e913805f15d1
- SSDEEP 384:2iFiZcI2sNh8TUNTUlIlt1MB+t4Cf+682IXeRFA+HBbsFgJ5oZ:dFQ2wwgIKGAAgF5W
- TLSH T112C219F248E79876D9AD9753E77E2D134EBCC067B5846A40B3D86A1CCC461BFD30A812
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 695646bcb9d8cc4437d121b0427eb8bef4d9b6da85497ffcf6e2bb0088702a2b
- MD5 019b68ecaad10489fe3a7a749e5989f5
- SHA1 c3d58b969cd2a942a40f41c983917bde2264d004
- SHA512 09ae766576cf3aaea3948daffa32a5271e41fa108f7cffbda83be037cc9ac7da1f72b3cda76b35a35bad017be3bb70e8563da83e5b327a376e9d79f6267f91b7
- SSDEEP 192:iONC6hZHQmiUybAec/+jV0jzor2IXQN2e5cOqZq9U6:iONC6Fheu+682IXes9AU6
- TLSH T19612FB36A868BC675DD2A655F09732139EE45227DEC57F84E6EC2F1C00DF6AC134A823
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 18KB
- SHA256 33a328b60cd1dab81f8eabbe1a07921f70150e3319ffa9ef5ab8dfa1431b4ab8
- MD5 1ad651869973ef2b8b83b60ddfe55245
- SHA1 83bda9018c6acebc97c86048d405a14b5bf68c27
- SHA512 8edc9c62f0da95573b9fcc5c4fb44656d05be03335c6397811c82187c2e0086e08a1695b391cb0ba60791cdc28cf2086ea29681b54511d36897c5012ab76f38b
- SSDEEP 384:5ZcIhsN/t1MB+tUCf+682IXe/FA+HBbsFgJ5oZ:RhXKGcAgF5W
- TLSH T113829E369878AC7759E2D256F05736134FF8816B97C86F80E6EC7B1D04CA6A9130BC27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 39c9dc1f76771ff3a6aa1f0d4c287b61d8ec153946f2892792eae8cf5c7a55d2
- MD5 67cc685347abf6605ba2ce67edd2221b
- SHA1 4033d11fb0ab2476aea15898b9d22516b5d8fdfb
- SHA512 c6dc4110162ce573fab0557199b4152984b2096849d40333cc14f09b6d0515a70cb063ed60a42c66ed801f6ae28c9d2b686896174bbd31e9cbfdd3e02ea585ac
- TLSH T156412C58BAEA1144B3B76E46ABF2686E487F7C372E0AD45D10110E4E0A66B44C871737
- MD5 SHA1 SHA512 TLSH