Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 20:39
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://bread.fish
Resource
win11ltsc2024-20260911-en
10 signatures
150 seconds
General
- Target https://bread.fish
- Sample260916-zfe56adh82
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2432 msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340647736340701" msedge.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650287814-2715975232-1279715623-1000\{416D5F1E-9CBC-45BF-872F-BA4F0A8FFA7B} msedge.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5552 msedge.exe 5552 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe - Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe - Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 3124 wrote to memory of 4628 3124 msedge.exe 87 PID 3124 wrote to memory of 2432 3124 msedge.exe 88 PID 3124 wrote to memory of 1436 3124 msedge.exe 90 PID 3124 wrote to memory of 3388 3124 msedge.exe 89 PID 3124 wrote to memory of 1436 3124 msedge.exe 90 PID 3124 wrote to memory of 3388 3124 msedge.exe 89 PID 3124 wrote to memory of 3388 3124 msedge.exe 89 PID 3124 wrote to memory of 4536 3124 msedge.exe 92 PID 3124 wrote to memory of 4536 3124 msedge.exe 92 PID 3124 wrote to memory of 4536 3124 msedge.exe 92 PID 3124 wrote to memory of 5588 3124 msedge.exe 93 PID 3124 wrote to memory of 5588 3124 msedge.exe 93 PID 3124 wrote to memory of 5588 3124 msedge.exe 93 PID 3124 wrote to memory of 252 3124 msedge.exe 94 PID 3124 wrote to memory of 3232 3124 msedge.exe 95 PID 3124 wrote to memory of 252 3124 msedge.exe 94 PID 3124 wrote to memory of 252 3124 msedge.exe 94 PID 3124 wrote to memory of 3232 3124 msedge.exe 95 PID 3124 wrote to memory of 3232 3124 msedge.exe 95 PID 3124 wrote to memory of 4448 3124 msedge.exe 96 PID 3124 wrote to memory of 4448 3124 msedge.exe 96 PID 3124 wrote to memory of 4448 3124 msedge.exe 96 PID 3124 wrote to memory of 1800 3124 msedge.exe 98 PID 3124 wrote to memory of 3512 3124 msedge.exe 99 PID 3124 wrote to memory of 1800 3124 msedge.exe 98 PID 3124 wrote to memory of 3512 3124 msedge.exe 99 PID 3124 wrote to memory of 3360 3124 msedge.exe 100 PID 3124 wrote to memory of 3360 3124 msedge.exe 100 PID 3124 wrote to memory of 1632 3124 msedge.exe 102 PID 3124 wrote to memory of 2456 3124 msedge.exe 107 PID 3124 wrote to memory of 2468 3124 msedge.exe 108 PID 3124 wrote to memory of 5020 3124 msedge.exe 109 PID 3124 wrote to memory of 4436 3124 msedge.exe 110 PID 3124 wrote to memory of 4436 3124 msedge.exe 110 PID 3124 wrote to memory of 3092 3124 msedge.exe 112 PID 3124 wrote to memory of 3092 3124 msedge.exe 112 PID 3124 wrote to memory of 5552 3124 msedge.exe 113
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bread.fish1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7fff68fac188,0x7fff68fac194,0x7fff68fac1a02⤵PID:4628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1940,i,310442979676244766,6221054044293720136,524288 --field-trial-handle=2696,i,14482419254447455762,11719498026755294726,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:112⤵
- System Time Discovery
PID:2432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,16717671718619122592,12879152920228964543,262144 --field-trial-handle=2696,i,14482419254447455762,11719498026755294726,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:22⤵PID:3388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2364,i,17360846674868334448,7801698978772734753,524288 --field-trial-handle=2696,i,14482419254447455762,11719498026755294726,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:132⤵PID:1436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,2074742419834528851,1574418118942170562,2097152 --field-trial-handle=2696,i,14482419254447455762,11719498026755294726,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:12⤵PID:4536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,9639491428844080421,8168782578942539566,2097152 --field-trial-handle=2696,i,14482419254447455762,11719498026755294726,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:12⤵PID:5588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,2092245412856041053,4786259005934661320,2097152 --field-trial-handle=2696,i,14482419254447455762,11719498026755294726,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:12⤵PID:252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,5800935965216003096,6941575308846334615,2097152 --field-trial-handle=2696,i,14482419254447455762,11719498026755294726,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:92⤵PID:3232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5384,i,18356103461112247255,17249771674874419386,2097152 --field-trial-handle=2696,i,14482419254447455762,11719498026755294726,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:12⤵PID:4448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5600,i,9191035023849170220,7405929725105973111,524288 --field-trial-handle=2696,i,14482419254447455762,11719498026755294726,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:142⤵PID:1800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5604,i,11794155101293104739,16363865416738676223,524288 --field-trial-handle=2696,i,14482419254447455762,11719498026755294726,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:142⤵PID:3512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5980,i,9132367528922445280,15971039523700306626,524288 --field-trial-handle=2696,i,14482419254447455762,11719498026755294726,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:122⤵PID:3360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6356,i,74090616437651247,7411911073728003213,524288 --field-trial-handle=2696,i,14482419254447455762,11719498026755294726,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:142⤵PID:3684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6356,i,74090616437651247,7411911073728003213,524288 --field-trial-handle=2696,i,14482419254447455762,11719498026755294726,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:142⤵PID:1632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4320,i,8953557892503957767,12559161746539480089,524288 --field-trial-handle=2696,i,14482419254447455762,11719498026755294726,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:142⤵PID:2456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3808,i,14030078362435564158,7223377118870576590,524288 --field-trial-handle=2696,i,14482419254447455762,11719498026755294726,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:142⤵PID:2468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4308,i,15477587332600851872,15752699676196059839,524288 --field-trial-handle=2696,i,14482419254447455762,11719498026755294726,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:142⤵PID:5020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6652,i,5062851734253067330,15790129219368270858,524288 --field-trial-handle=2696,i,14482419254447455762,11719498026755294726,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:142⤵PID:4436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5728,i,4812791711012277536,15960948962465172365,524288 --field-trial-handle=2696,i,14482419254447455762,11719498026755294726,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:142⤵PID:3092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=800,i,6877964678207041895,8435745360909801539,262144 --field-trial-handle=2696,i,14482419254447455762,11719498026755294726,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:5552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:4288
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:2140
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:3080
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
- Size 105KB
- SHA256 7331d61b72578f10058ae20f1a7351dc99070a754006884c0b775bb57bffd9cc
- MD5 df1098b0a62fea8609e624a81ae2865a
- SHA1 eb148addd613d8dae155058eacdf967eae295b15
- SHA512 0ec5916b4d090394f668a1ee0ca76c2125146f8b8507c9e7dd1bb90a8aed21e61551b85c2a32b975aea241df7bda238c513a58ebe378cd3af3d77e71803ef6d8
- SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
- TLSH T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 e0217c0f2953c25b5ecacbfc82728d57c809cf5450e9203a48d2faaff8836c2b
- MD5 04b3b3f543557524e135a08dac44efda
- SHA1 4f856c66c17971828ff8fd245186ea6b1b303bc7
- SHA512 a11f6ce9f676e6157f7d9b86de7e7c3f0b7758052de5b00121c54342e363951818cf7787ed1baf39e636241455a76f6b90dc0405f5eaf0361a7c1056c3560c1a
- TLSH T1F5D02B71EFBB6C03D184207C100182C01620FC40BF6902C4170001A4042C5444313205
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 6ff73de37e74e04bc32af0dd2dd926bcd2d6c623deb8eb066c65071254002178
- MD5 a569aede49695d8fc8b039ab7024fd75
- SHA1 de14644ea578b78d3cd08753552602517297fd30
- SHA512 b87c4dc8e3e3be51d402a4d2d6166ca389ae05ea059903425483e2dcc38b0f2394d29a7a81921700d62e2a403e94a7b3e6c02c186966742a945996df580c0065
- TLSH T18FD02B71EFBB6C03D184207C100282C01610FC406B6902C4170041B4042C5444313201
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 a1a86f2010a87c9d15848e0bf6a01a1f168fbcbfbb53f27ff542d0046e6951b5
- MD5 62f3cc82c370486eeca5d922d273ffe4
- SHA1 3f3b99208f04c089f24c700028fcd0fe2a2633c7
- SHA512 5d11298f8727d6b1cc75313cbede1408b30199b06cdde9057e40ba9f8593643e25ded84e6878319a37b9d4a4322d6f6e83fddf9d510a1939b4e2a8b7ead3ba62
- TLSH T154711B7E76A0BDA9FBD8403D45FBECC7353E46E5B1830EC20699D8793576798808C458
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a31c.TMP
- Size 3KB
- SHA256 87321bcb33d1e82c2d87ddb6d8831414846613dbaa0da6dc8acf15d86943926e
- MD5 41c21e5067e37f1e26afb0e374e91a7d
- SHA1 dbfc0dc1025dfab4bf0193655950735d5019fa94
- SHA512 d258233d118fdb25af126adfa89e6c064ad24e867cf9d0df6d467075bc6bc89997eeb9de5f31207d99ad8c62ca96739c7aa38c05753f0ccabb9bb5dc0fa4f0cc
- TLSH T100615E7D36A0BCA8FBD8407D85FFCCC7363E86E1B2830DC20A94D8752572798808C158
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 5KB
- SHA256 a32675ea8da77737b99d6c39df71ee0dd75b2782ea86e7ef3bda6e4e3aaab50b
- MD5 6746558b117cf7985c000e432fded72f
- SHA1 a54cc1f8ed400fce91e11b895d40ef0a3d44f242
- SHA512 fff1adc55a2b92842c1829fb1ac4582a17f82b0d237a770e37dc6201198af28410dd4c7aeae22a029f673adc7e3bd3eb438477d46b4207de5e444ace77f26e09
- SSDEEP 96:Dh8Zh7caaVIuNGWztVB2PASHknV0QXwyOO:Dh8Zh7caaVDQWRVB2PASHknV0QXzOO
- TLSH T176C180F3C3E8872D991151F56A29BF2BCE1C0964931C3D368AE4AE4FA3F1472D141A5E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 10KB
- SHA256 bd93b7e02f3167e47f46fb5048a2dd51cb387d1cbee8391d3fd22634130b8576
- MD5 9e644dd3d88f39b4b85d39cc9cc6e05b
- SHA1 b53968c24c78447c2a3a4493dd387a4ac922821c
- SHA512 803f002798e4fa75833cb2e8404ce567c23875caa64a60b595a2bb8ad40b63008af913aa44bb5314fcb45cb4c0cc96f43bcfd861335bba8a56a6e48ecdfa57e0
- SSDEEP 192:sxR/RpbA/fQsbezoA8pWq/g6+WN4fV/YFvjGlIgIJ:sxR/fA/fQsbDp/5K/3s
- TLSH T123328515AD28A97B8CCBD20DBB65BF53D2FD5032A1952E48A6FC971C04E76DD120780F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 11KB
- SHA256 9d8b7b488e4e85e5ca67e99c3413f3e40b436f7b0f509cab92edbddf694c756a
- MD5 902f338b504b6efa2ebe3cd3bfd5a423
- SHA1 ac99b89501eb5140915c7f8cfd5e192580ff2b10
- SHA512 06b3e75c837c22abeee3216c73451153894f04192d964608e6b0204d3f25b2015b6289bfcc16a1965b44a286f783ab0058dd1aeeff458a4681e0793d1a23c859
- SSDEEP 192:sxR0RpbA/fQsbezoA8pWq/g6+WN4IvVrYFEjGlIgDB9J:sxR0fA/fQsbDp/5DVr+x
- TLSH T109329515AD28A97B9CCBD20DBB65BF53E2FD5032A1951E48A6FC971C00E76DD120780F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 10KB
- SHA256 58f866c0f678d7986cfe50f2b1f38421e4d3f7ec8e5c32e15adf67dc7030a5d5
- MD5 bbd962a0b47e3f0f1d280b4606a0026f
- SHA1 938db158bfdc560fe231139a71dea0069876d1da
- SHA512 da0560e490c0a888936cd9573a7dc7eda29e8eada31a8385bcc70a72c8c7715b6a5c282ebffae6fb75137ffd24fd8027e920d4394808d41ab88a55884774fccd
- SSDEEP 192:sxR0RpbA/fQs3ezoA8pWq/g6+WN4QEXYFSjGlIgDBrJ:sxR0fA/fQs3Dp/5cXAz
- TLSH T17C328515AD28A97B8CDBD20DBB65BF53D2FD1032A1A52E48A6FC971C04E76DD120780F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 23KB
- SHA256 503baacbe3de9ba49e6a2725585a278f034ccefa8fb356f321370c17acba84dc
- MD5 beee88c0f92405cc0938220e6e649177
- SHA1 8a5ff2e6e3af977ba619ec9a55dac41317700b11
- SHA512 7aac609610fffb64222101aa58e04ebeb79ddd92918d64eb3cd4d6fd5554c7cc0400c4ef6fd7ea94c9b76182b9010b14a85990cc2795973d3354792c22dcb437
- SSDEEP 384:+0e2P7wfCtgwiFf4eKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVS29aSRndro+P0:+l2P7KWgwef4e8F1+UoAYDCx9Tuqh0Vr
- TLSH T1E0B2DA2F640CCB7E4FD04A9DAC196EDB6DAC02C796588D4047FE994C03C77EA921A4DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 4KB
- SHA256 8430b026307bf44f7c749daf9563f0ed13bae9f1e92494d60f3b0f865d650f98
- MD5 8fbd953731692203b924accebcd2228f
- SHA1 397f6091b2f4761eda3abd0777d3fce31973fbbe
- SHA512 c4eef7dfad943863b8591dfbe67bf9c471cfe1995e0b35a0aaa271653440f00408c26309ccb20cee0bae01f7df2ba9cfe43856d0f169e905aa4e116003a2eae0
- SSDEEP 48:Kh4d8o+a2kGaLPILgkKEBcWkQI0tr+I5yKL0bL0AL09L0RL0bL0NL0tL0xaL0xLX:KArSKoIquhKKyY6SwQK1Sl
- TLSH T15E910425317B0A813EFD3608A2D9979E575131633929F62B7BE940934E2EE040CFE8DD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\8cd08661-f2ec-4c5c-8c23-aa279fc25874\index-dir\the-real-index
- Size 120B
- SHA256 8480cc465ae15daf025fc5fc711f72124e32eb3397a59c9f73d14445aa27805f
- MD5 bdab211e8218880534fa7adfe2e09834
- SHA1 c72eddbe6fc3d8ba1c8d1f4ef60b9b82ba25af8b
- SHA512 72732e277b830389c4c8bd6f28c64d4848db799f722af034e08af70ba0c404505c64247ed3be93c049ba7787dbe56142ab4b6d5499dbce147324dce0842ebfb0
- TLSH T11CB0125994E11703C55002B0412E05527B351D14ED44010390E0329EA5975E4826307C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\8cd08661-f2ec-4c5c-8c23-aa279fc25874\index-dir\the-real-index~RFe59c6c1.TMP
- Size 48B
- SHA256 4118f172d51080ca0472d09dadbb7e6c32e07bc7f6801d9ed06e706fba09e3cb
- MD5 91a424dcf7e312948ef91737c240e835
- SHA1 8cc7f7373c5fbc2531e71b549454e2f4ad9817b0
- SHA512 9ffa52888bb0e89fc004904fbabc975866a1f2eb13d808958991195686b6bbcc9497dd49b6f0a93f2d9a9626b3a46cb5e2968b9d70def6dc799167f99a88b228
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
- Size 94B
- SHA256 1b4aee3b83985559e79fd41c45a6774c0754051023b1760285633c3359510d54
- MD5 1274a0d14a35fec7b6b55c080c041a2a
- SHA1 7420912dfbe8f80feac0dbb4cff7adfef9410f53
- SHA512 fdda9ca3d31c40f776fd308244c873f1cc0d68cb60d125ed8d416004466a0256dd63a7c66097741e4b3cbc1f938b20bc5b23b4057801d7e34a12d5ce7ba461a9
- TLSH T133B002BF2858C08F0A6055E56420755DE10B035D4CC8C9F88945D55571295671D41C13
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
- Size 175B
- SHA256 3d2d717d2c0f8fd58464270b25b689ea176ae3bfb250a6cfe6c6ea3c13f0de1c
- MD5 4f58c19776fd50e8481ac94c0b29c6d7
- SHA1 97bb046d411b699ff49fca570403c1dc539b1473
- SHA512 f5185e5999373962c911251867191bf9c38f5e794375235831ee9a34b00f1c75be849f1b6f36c12709935092ab4dcb97701daf0e869fcbbf2a38c22a2f8e542e
- TLSH T17AC012AA2968908F06A056E068203A4ED54A0A298CC9CEA88A49B50630388639E05826
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
- Size 169B
- SHA256 1e899262d3a392dad23abfa51886503cde157bc64ab538b7b4c2bfcb61cd724b
- MD5 000d9d0cec5d39fa01820ebc26e038bd
- SHA1 96dfe83e78771c1268d1b09725c9f9479499e08c
- SHA512 f44f9fb18e15674f80476fb3ebdc2ccdbe35d7d72219e1d236cce43504cb586bec64e0dc83e694cf161d18ecfe9e9b35d4e23bf2f85204ba28d5f1698c22fa15
- TLSH T127C08CEF2868D88F0AB097E868103A1ED50B03788CC9CEBC8E488506303C8635E02C26
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe59528b.TMP
- Size 178B
- SHA256 46d8156b7bd0ab41ba374c8c86a3f3ad06964db03afe7ec7b711e1a7e5d7d9f5
- MD5 5fd290ddaa4dcd61cc2e64541cea9492
- SHA1 43480c388bfc4f347c4fa9a777f9a2c1ca7ae91e
- SHA512 bd9e62defcf3ee8d945bfffbf8079184c7d0d1422dc02eb70fe7683da7d654cd928199b6209eb836d93f856dc2fa7e1e6cd6e9b837a71086f2eda4b5f481938d
- TLSH T139C080BF7534C04A1A60E6E5543D714C901A4F5A6DC8C8BC9801F05A30386536A02C12
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a34dc.TMP
- Size 3KB
- SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
- MD5 904e6e94a1d46374c8630cfd86cc729f
- SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
- SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
- TLSH T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 34KB
- SHA256 d2a6b106b4dec6eca3655105eee6b0c5256b99eee83dc5f98ad02b63135b5ad3
- MD5 8698d5481d40e04329c03c0ce2f8dfe9
- SHA1 54c8cbd1a89748e96d9576fb0da28e992eb6f23e
- SHA512 dd5fcc2309e92f87ae44e892dd72f3df466dc52e442e934e3aaee3a4b4ee5d544114bd099f4a0012870170d6dae91b2567159b32b94ecbeb94bbefcc0f918c08
- SSDEEP 768:vz3A80f9cMlSyEMbxyJugQVTJ7vvmeXtMgYDs:vz32hlSyEmxyJJq17vXMgws
- TLSH T185F2AF31ACA59C7798E68281B646B743AFF442A354D92B94D8DD9B0E018B7FD130782B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 34KB
- SHA256 d2782cd91ffebb32fe0ac7fa2b1da7148c135af41c99e53547d71ea708d14f39
- MD5 c936e149bced78add114a19f4fe4ebbc
- SHA1 0b0a2eed8f1c870da8940fd436787da1b74f91c3
- SHA512 9e174d3fc7324853d4f61c9f307812892cf9082e595d69c3527d26463bb754d9a59cb5a4ebaf4629d2285cf890ca155d69dbc6ccbf7db414762dbe4c7c9c1335
- SSDEEP 768:kz3bW0f9cMlSyEMbxyJugQVTJ7vvmeXtMgYDs:kz37hlSyEmxyJJq17vXMgws
- TLSH T191F2AF31ACA59C7798E6C281B646B743AFF442A354D92B94D4DD9F0E018B7FD130782B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 37KB
- SHA256 cf4ccd33f04fb3c9fced487b6eba2c2d9f6bcd89136c97c3546d2aa23735b108
- MD5 017ba94d25ff85685d34fc4be9e85c9a
- SHA1 d3dc73c27780c987f0df43d3b64c037f0d3bd5df
- SHA512 692915ba909c7be1a34ed2def98b192eac76a0557e1e22e4f305896e42a076233ab2f789a9b7f648f1ccd157db269265fc81ec4ce25e8cc7744d5cdb401b9c64
- SSDEEP 768:p/UxvxjgC+k3rAf9cMWyEMbxyJugQVTJ7vvmev3SHtBk:cZj3+k3WhWyEmxyJJq17vZSbk
- TLSH T10903CF35ACA55C7388F792843649E787EFF506A394C62BA485DD6F0E128B3BC5307817
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 41KB
- SHA256 d96fc4f9b5375ec6f924092a4579ba66e89d25871e8b6b6d86e1be0da34234b7
- MD5 eb549bd4fa1255819dd2b72625813b53
- SHA1 a1fbc22ca288c777816e394aee981b89309a64ad
- SHA512 b1b7298cd5cc489e0a66de833ca1b775d780cc17a951c1a8155ab8af40db1a83f860403a68895802274c41ce357370ca5bf8ecaa914b56dec78cc7c2c62670e1
- SSDEEP 768:jFQf3Hwgzi0f9cMlEyEMbxyJugQVTJ7vvmeXtMgYDs:Gf3xhlEyEmxyJJq17vXMgws
- TLSH T186137CF158D78877D8AE8783A73D6E429EBCC163B4956644B7C85A0DCC862BFC307816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\194c1a5f-7ad3-45c2-b6e3-2dd54bab3796.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512