Analysis
- user interaction
yes - max time kernel
148s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/09/2026, 12:18
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://hxxps[://]offer.sellizer.com/TwDz9sX2o
Resource
win10v2004-20260911-en
11 signatures
150 seconds
General
- Target http://hxxps[://]offer.sellizer.com/TwDz9sX2o
- Sample260916-pg3bzazerh
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3868 msedge.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340347428442508" msedge.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{847907D3-9016-4E2B-A8C5-8CD8F8F41347} msedge.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 772 msedge.exe 772 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe - Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 4968 wrote to memory of 1628 4968 msedge.exe 82 PID 4968 wrote to memory of 3868 4968 msedge.exe 84 PID 4968 wrote to memory of 4860 4968 msedge.exe 85 PID 4968 wrote to memory of 4860 4968 msedge.exe 85 PID 4968 wrote to memory of 4860 4968 msedge.exe 85 PID 4968 wrote to memory of 4112 4968 msedge.exe 86 PID 4968 wrote to memory of 4112 4968 msedge.exe 86 PID 4968 wrote to memory of 3948 4968 msedge.exe 87 PID 4968 wrote to memory of 4024 4968 msedge.exe 88 PID 4968 wrote to memory of 3948 4968 msedge.exe 87 PID 4968 wrote to memory of 3948 4968 msedge.exe 87 PID 4968 wrote to memory of 4024 4968 msedge.exe 88 PID 4968 wrote to memory of 4024 4968 msedge.exe 88 PID 4968 wrote to memory of 2680 4968 msedge.exe 89 PID 4968 wrote to memory of 2680 4968 msedge.exe 89 PID 4968 wrote to memory of 2680 4968 msedge.exe 89 PID 4968 wrote to memory of 3392 4968 msedge.exe 90 PID 4968 wrote to memory of 3392 4968 msedge.exe 90 PID 4968 wrote to memory of 3392 4968 msedge.exe 90 PID 4968 wrote to memory of 3672 4968 msedge.exe 94 PID 4968 wrote to memory of 1356 4968 msedge.exe 95 PID 4968 wrote to memory of 3672 4968 msedge.exe 94 PID 4968 wrote to memory of 1356 4968 msedge.exe 95 PID 4968 wrote to memory of 3488 4968 msedge.exe 97 PID 4968 wrote to memory of 3928 4968 msedge.exe 108 PID 4968 wrote to memory of 3736 4968 msedge.exe 109 PID 4968 wrote to memory of 5056 4968 msedge.exe 110 PID 4968 wrote to memory of 4720 4968 msedge.exe 112 PID 4968 wrote to memory of 4720 4968 msedge.exe 112 PID 4968 wrote to memory of 1356 4968 msedge.exe 113 PID 4968 wrote to memory of 1356 4968 msedge.exe 113 PID 4968 wrote to memory of 772 4968 msedge.exe 116
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://hxxps[://]offer.sellizer.com/TwDz9sX2o1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2dc,0x7ff97300c188,0x7ff97300c194,0x7ff97300c1a02⤵PID:1628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,10250746326099626550,2458658725485534644,524288 --field-trial-handle=2476,i,15027757042201999520,17924132621317867984,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:32⤵
- System Time Discovery
PID:3868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,7448939526636006765,11766579511644711721,262144 --field-trial-handle=2476,i,15027757042201999520,17924132621317867984,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:22⤵PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,15542330797953319888,5676649209990365449,524288 --field-trial-handle=2476,i,15027757042201999520,17924132621317867984,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:82⤵PID:4112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,14909788118684999182,7718848984817876074,2097152 --field-trial-handle=2476,i,15027757042201999520,17924132621317867984,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:12⤵PID:3948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,2896453769611454680,7155769553070963958,2097152 --field-trial-handle=2476,i,15027757042201999520,17924132621317867984,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:12⤵PID:4024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,9466811728042330162,9616386152459218540,2097152 --field-trial-handle=2476,i,15027757042201999520,17924132621317867984,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:12⤵PID:2680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,2311857335815292504,16987696147785843983,2097152 --field-trial-handle=2476,i,15027757042201999520,17924132621317867984,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:22⤵PID:3392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,13303701237731058114,14834459074712505859,524288 --field-trial-handle=2476,i,15027757042201999520,17924132621317867984,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:82⤵PID:3672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,103705055595755104,11999000795742764532,524288 --field-trial-handle=2476,i,15027757042201999520,17924132621317867984,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:82⤵PID:1356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,2351554060422553799,4633351709570398664,524288 --field-trial-handle=2476,i,15027757042201999520,17924132621317867984,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:82⤵PID:3316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,2351554060422553799,4633351709570398664,524288 --field-trial-handle=2476,i,15027757042201999520,17924132621317867984,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:82⤵PID:3488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,3253396740792168521,416581823933141777,524288 --field-trial-handle=2476,i,15027757042201999520,17924132621317867984,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:82⤵PID:3928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,10229448017654394396,12793497294744126506,524288 --field-trial-handle=2476,i,15027757042201999520,17924132621317867984,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:82⤵PID:3736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,18237930204967910076,6895603940998381331,524288 --field-trial-handle=2476,i,15027757042201999520,17924132621317867984,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:82⤵PID:5056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2992,i,16974159062543242448,3076719521869883276,524288 --field-trial-handle=2476,i,15027757042201999520,17924132621317867984,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:82⤵PID:4720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,13472004160503752557,7266468135385496248,524288 --field-trial-handle=2476,i,15027757042201999520,17924132621317867984,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:82⤵PID:1356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5192,i,9553132839668037012,11018755809452389871,262144 --field-trial-handle=2476,i,15027757042201999520,17924132621317867984,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:812
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:1352
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
- MD5 99bbd8400adc948f85ebd87cb24b3fcb
- SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
- SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
- TLSH T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
- MD5 74ef2da89fa243ea7d0030317efca192
- SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
- SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
- TLSH T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 fe92dcb3f0c1c8fbedcac3739fdbd83751f362969933b705d482032b459fe97c
- MD5 d03086151765bcbedda6dcee2a92b86d
- SHA1 e69754c0091c32b03b405d183f29350b01e079d8
- SHA512 364948b2ba59d515c6249c874414a0665c553d324368956b528b81fdc5aea09cd352f4b326307810ba5b6ff859c6163fc6c0f8f82728ac66630264537bbaf67c
- TLSH T1A481F4E2FAC399D8FFA77C7090A5CFC92011444EC4412F2BC498D6BA64073D386B9266
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593f03.TMP
- Size 3KB
- SHA256 72b44a819fd2d594cc667380611f0a5022bd4210b415471a13f40f90c504e80e
- MD5 fd92d47078d817d8343e6ac320bde436
- SHA1 6ba4227787b6d304c2c691cd14a3abc82a2362da
- SHA512 7cf4f2fa7752fff697b5aecd0861ee08dccf0f20c918dae76864acf85160161abe529179283ef09f9e08b8f4ac4b9c2a34d8b50e8e51d67e97909d706549380c
- TLSH T101615E83D34342E9F7AA65B095E29DDB3A34909784433F3EC8C8CA75A807726DA1D077
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 e404a2a4a6c0e468a202abac12b886236d01688875b88d168e4c62de93f75b8f
- MD5 5cac7472b193c55826c5bdadb7033f8f
- SHA1 fcd4ddab72919a482772c93f646b30e33bb5eaad
- SHA512 a50617fb4ca244ff9f1077eb1140f6c42d217b8fac488e63f35282dd3f1fbaa5ef2f1d920c7f1904ab8ca8338cc14589ae52d15401c6463d60e73f2a9b7ea023
- TLSH T1FA51AAF7C3A6826DCD0196F09A18AF1BCE1D0452436C3D5989D4AF5BA3F2861E112B8F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 11KB
- SHA256 6e69f0a7b98c6de78bd6f2735454d37d6b591a2e986cc8f5226dd07651ad58fb
- MD5 e44d65600f3eabc3311ac23591702436
- SHA1 5cf628964b3b9325c596159c257995e2652305dc
- SHA512 f36781b58076330400b9fb210ee0ce19e279d23c57782ffa7ac79d681b7c5a8514de945c43269f2476599480df1e25f8d345bc2ed86fa716981825860d100fe5
- SSDEEP 192:sxZtRkMOq/fBstq9LMbGQdpmpHW6+WNBmIb/YapeYZIgrJ:sxZt/Oq/fBstqRA+Hbsk/d9
- TLSH T1AD32E816BD28A83B8CD7D65DBA15BF43E6F9103395D41E48E6FC8A5C08E67CD120780B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 11KB
- SHA256 95732e258ecc808fcf8901b60862b0f33ea3d631ccf8a66c7108fb129622476f
- MD5 7da1fedb57ca3c2b1a627ab498d10ff2
- SHA1 0866a51c5ecdd2aad2565cca97b8b8cc5cd106ba
- SHA512 3b31de4f5f469f705614c15111f1308d6f168f5e8ce21310066787048a13a82529cd91f2308da72aef84202bd33b15cf78465643d9aef3c2c8db8833c32a0610
- SSDEEP 192:sxZtRkMOq/fBskq9LMbGQdpmpHW6+WNBmIb/YapeYZIg5pJ:sxZt/Oq/fBskqRA+Hbsk/dl
- TLSH T1DF32D816BD28A97B8CD7D25DBA15BF83E6F9103395D41E48E6FC8A5C08E67CD120780B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 12KB
- SHA256 6bfd8b2b7123e892e55a2c1f88710d5fd167892cb7e99ee86fea1999edaed693
- MD5 8754f76e887908b8554c3e6e31124eb5
- SHA1 77ff77af783e98cf310565741752085da0efa4bd
- SHA512 007b76feaff53e796c52340d8a01dad59c8331142a9f1897c69ec2f971aed9c20b4bd0455ad60e241f2c7ba61f6b3aa17789c40eb9c773fa1f2e6082f06c126f
- SSDEEP 192:sxZ3QUncRkMOq/fBsRVq9LMbGQdp4pHW6+WNBmIb/Ya2eYZIg5TJ:sxZ7nc/Oq/fBsRVqRAkHbsk/GL
- TLSH T12A42E716B928593B9CD7D25DFA16BF53E6F8603395D41E48E6FC8A1C04E67CE120380B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 11KB
- SHA256 2d3a69b4a978f847c1f01445c2989c0204dcbe51597d1cb6e4c92457f893e3ef
- MD5 ef54dbaf760617b5d0d6a5b05ba009e8
- SHA1 350408f9755df0731c634c2acca58c9e9b9d609c
- SHA512 e0db55fb97ee9721a27d0e63160a592aa6088f3f174587843fc2c8b38406903c9d731c3fc616600a17c39159e99717aad42ca59afa79de2662ea1493ab946826
- SSDEEP 192:sxZtRkMOq/fBsRVq9LMbGQdpmpHW6+WNBmIb/YadeYZIg5TJ:sxZt/Oq/fBsRVqRA+Hbsk/BL
- TLSH T18A42E716BD28983B8CD7D65DBA15BF83E6F9503395D41E48E6FC8A5C08E67CD220780B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 27KB
- SHA256 4497ea6861bd0db8029096cd0298d28ffb0baba08ab91eca82219f48159fc7f7
- MD5 a4c0b3f6f17453d93faea634f74820d4
- SHA1 19de3b93244c45822b0ab23d78970a2518edaba1
- SHA512 2c36919ec673c5ddb8ce78922617408b998ce435ad6cecfc217d078a372e4931626a941424a3668d153afb0d0f31229e5948c145d961e75edc7a9cade97197d2
- SSDEEP 768:gpyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3LronZI7:gpyQRbrWvvlpZu1jaXKLf334nZI7
- TLSH T151C2E92F640CCB7E4FD01E9DDC6A6F976EA802C766588D4047FA984C02C77EE512A4DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1adacc9b-26d6-441f-8c91-36a9b595a034\index-dir\the-real-index
- Size 3KB
- SHA256 9df9c38b523a1580cda051457c44cdbcaf92f697314730fb56c700cbfd70353c
- MD5 a642234f45da6e93bf282d01599b8fec
- SHA1 211026508756e1f85532fc95f536cb759cdb4edb
- SHA512 56c185b6c82f16367a1ad8dcb12119602eb43c8eda265e9b2caa1aa81a09dc7deb3fb55105bd0c2719da3e46c53182f0676ffba8fdd598ae60d8958b79fe0a5f
- TLSH T16C51DA0E9D075BABEDA8527114B508D4333425DC43642A1FA9FE8135FCC3B242DC5B78
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1adacc9b-26d6-441f-8c91-36a9b595a034\index-dir\the-real-index
- Size 864B
- SHA256 dc065acab088b9dc681f2d5ce723790ffea11273f3159250c28426caac3e7554
- MD5 7c0e8d98b3b1243abe9902a049f30cd4
- SHA1 df74985ff740b951d19a0532930348e922d8f351
- SHA512 516cb9c5152c8b94331256335ffc7f705ed43c0d6ef256ed40b7432d9d0e011fb520b71b5bbcc225fd04420c90e6071b795a165dec62188291d709a503e566b9
- TLSH T12A1162C92D135A9BFE600375603DD89D627501DC13012A4F21FEE12B9CA7B007E80AB4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1adacc9b-26d6-441f-8c91-36a9b595a034\index-dir\the-real-index~RFe58cfed.TMP
- Size 864B
- SHA256 798a549b4655f97a9a02d66ce1e872fa78ac56b29805abbbc55dca435c1a16fc
- MD5 1809f17417f9f9715383a2d360815862
- SHA1 c9c2dca5420ea5fb8db3b9717be1f6dc192f93a8
- SHA512 36e63cadbff2be2fd6956ca8523fc4e29b4bf9afdf03b78597f93cc9fceb04e43398d748bb21afb2ff9f23da94ec458f173151bd8fe854715341a8eba5400915
- TLSH T1201141E501638B0AFC4803719A3CA94B717942445344674FA3EBE12ACC82B80AD82FF0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2a544f4d-a007-4f3a-b210-5e4ea2a29b4a\index-dir\the-real-index
- Size 72B
- SHA256 670629879b3d4e283cc6a4d29cafdbaa6f282461e4846b051aec58a7de65ca6d
- MD5 e454751fa43015bc1583520c2a315673
- SHA1 d79e7f9601887a4c5995326cee4503e724f9d9d6
- SHA512 8eee97bd048a6d1673f60c748e067d4ebaeb09b03b2825075613eca5239805f044f5e6ba70ee0f25c5e4d97eab9a38c45aee4d23972782debaf90a32e09e2ac4
- TLSH T150A0021463C10211CC461BBC69E7C94A2312D91E0A051707F1900144CD50EC94D6522E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2a544f4d-a007-4f3a-b210-5e4ea2a29b4a\index-dir\the-real-index
- Size 72B
- SHA256 8c3c5238fdf22e8a7a10cd1c490418cbda266ffcf5601f11bb6d632df4e2675b
- MD5 51aaf20600e9b8efbfc0fe4a134d1a1b
- SHA1 1073312e0e85708357d981526fc6f863477981a8
- SHA512 ff40aaca8e91c988843700f1981ee49fb8d0b948eddb46ffcbf8bfee91550d112dc926634af77de29be3b2275faa06ae4b7f853e59f571f298d9cdb5fd77bf1f
- TLSH T167A002204BCB5615E42631F1155222751741C9505150170750D34484DCB24805E4101C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
- Size 371B
- SHA256 561e3c4a825ce54a009c435d13d597d151a16bb32ddbd2f9b46b8bf3ae1c5c5f
- MD5 7115eacd870b60467afbe531a36dd62e
- SHA1 c6e7bd2d029e2fbb5b317ee82b8515658206ce76
- SHA512 e97fb7b8521ec83c65b9e6a1f02038aab5f8fa03e6a4c893170133b93ae8d2d3575fa04883d99f21e72b92a4b5e144ecb61883fe4150df833582298837cb5559
- TLSH T1E0E026BB3EE72810ECFF93E2293144A50505F8549999FD5F902AD3CB50B23963876CB2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 72B
- SHA256 b19aaaa2bedf0daf1e68296627948170e854710db3461517f5457c7dcc1e24a1
- MD5 a2750c2c78f1181f81bb626ac0f6ae0c
- SHA1 1df1d1fdd629eb545fc190373b02ca849ab03f00
- SHA512 aa1816d72715474b8c9846928daf14779296583e4d88853d59958252c3a962711dc8cba5978d697dc92d5f2c060406940febfef0d89751f717b7a670a4572f4d
- TLSH T172A00239DA958551C80407B490754ABF7A70889D0A05371AD1ECB55A88551404193024
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59264b.TMP
- Size 48B
- SHA256 fa81fe9b9963a6c47ad7d0ca1d0abe7d1c0c09e7350d9231bbeba5d016ad31aa
- MD5 6d5b9c079d5f9971110bc0844a13b87f
- SHA1 0a1fc7871014cf4bbf446d76beac2bee3b1106ee
- SHA512 40d1ccc99188ba940f633a02c90422b855b9b5c88d9b18b88c0b2b23a5b5a367feef2c378f11b8d9978f853dc7379484b753d39dde363b8001e4dfd9467c5c7d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b56b.TMP
- Size 3KB
- SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
- MD5 904e6e94a1d46374c8630cfd86cc729f
- SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
- SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
- TLSH T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 83072b0f575d404b335f334db7150ef4ea955014845c1d89d66b739d809b918c
- MD5 db31a708dcbd2229815604d700f9fe94
- SHA1 786cdca27ed84964c1bd5ad88504cab12df88bd8
- SHA512 f6d023d40eb19f0482c7149547c95c8414fa8b885d09c7d0456049a8ee03f032685ae3fc2bd359a6b812660cb7539c5f21529aaf2c152cd90bb305c966509776
- SSDEEP 192:SONH6iDCQmiUyHdHq5u88PpPCPSqFicU6:SONH6/4Hq5u8ipaNVU6
- TLSH T12B02F8396C783CBB9DE3AD15B58B7B179FE9116FE6941F84DAE8161C00DB68C1303522
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 18KB
- SHA256 9610c230a7be6e439aca9f460167fee0ac9c99303ee6ba3b3b88a6a629f6fdd7
- MD5 6d1046962c2cf75d4d71713afe6afde3
- SHA1 f1afbfca59860b743120bb9db6d5ca5bd72fe1e3
- SHA512 e14eea3fd132f2d0af9eca674a2c5d5d7d2a7d840477a3b77021d16f999622bf6dfafe13a7d2dab1ff14d2e2bb31cab33295caa303c9a065e03e4fbe3222b808
- SSDEEP 384:tZcIFsNqkTyPexBhsup5u8ipaiNaBZBkwc0akboV:1FExkpUBZBkuakbK
- TLSH T1B9926D766CB46C7669F39152F8473B039EB88167D38C6F80D8DCA71E06DA6D81307927
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 f9bb99d93438fb9e7007790835faef791f6d3aa1b2ed06ededf2c06b9a50cb60
- MD5 c741bf28391915d62773a11e304d1393
- SHA1 7a1e173a569553d274d3e46369facc110c016129
- SHA512 69611fc9df5d79035cc95c63768b77d316a5c5ec617a13bf05cc8c3c1aecbdddd1a9af9cdbdf35336bc23a443b8b97e610d1f475d57a3c5e1696008ca0df325d
- SSDEEP 192:SONz6iD6QmiUyrdXq5u88PpPCi3da5uZ3/xU6:SONz63yXq5u8ipaiNagZU6
- TLSH T106122A3A7878AC7B6DE39961F44736139EA4426BD7886F80D9DC272C02EF5DC5307912
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 19KB
- SHA256 2bb9ca333e179401863def6a61c22e661de22b1ab09685d90afacbee2247e5e7
- MD5 9614025be238b599278ea1be373abb54
- SHA1 cc50d95d535dc2a883fcfc69acccc51939044a98
- SHA512 3b3523b3a9e7312da13f42a89d718f4077fc3e1df04fa4c859c0633916c54e302655e3e77333dc4d05c41cec5e18db446aed7c50369210983a81126b3c2c97ba
- SSDEEP 384:rZcIFsNqhTyPexFqsup5u8ipaiNaBZBkwc0akboV:zFgxkpUBZBkuakbK
- TLSH T149926C762CB46C7668F3A152F9473B039EB88067D38C6F80D9DCA71E02DA6D81303927
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cf159ad7-1828-4662-932c-653e16c7c758.tmp
- Size 21KB
- SHA256 8543c559b412943fbd21d27df4a98ac73c5afcd277392c50f0a1b86f83bc985f
- MD5 2511d8eea95267a5c90e91817d517293
- SHA1 b345aa640fc4f60392286382f0cf281e736d2b43
- SHA512 745bcb1ee07695bc1f6e07071224c24a1c0ffe79eca602b23e3bf284b840f24ef9d81e1283402ed93031600047a3936a2a2c2dc8dea763b8697b72c1a8391cf4
- SSDEEP 384:/iFiZcIOTsNy8TUNTUlIlhTyPexFqsup5u8ipaiNaPZBkwc0akboV:KFQS7wg0xkpUPZBkuakbK
- TLSH T1E0A26D775CA49C7BADF79A51F94A3B03CFB48167C298AE80E6C8971E01DB1D81307D26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\aa525a30-e9d7-41be-a248-7d61387d15be.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 ca9c91acf11ddd393a3b7976ceb52db410ec415c314c0bf18a7df5b263b42361
- MD5 5d1aecb4bc4d37ea270661afc5345d96
- SHA1 d66829635b59e5be7d49458055d376bc2b3cdc22
- SHA512 a349762fbc64066b1ff9ef05aa34cccace98fdb158f27f2fafb2d5d0d56ffdaa99988a614387f27dac30f7ebe4317ffaa7b91a2974bf9c8e06757c17d45bb3bc
- TLSH T15941F698A6F91108B3B37F5A9BF7A4AD487ABD372E0BD09E00110D4F4A62B40C871737
- MD5 SHA1 SHA512 TLSH