Analysis
- user interaction
yes - max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/10/2026, 09:17
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://federal-gov.be
Resource
win10v2004-20260911-en
10 signatures
150 seconds
General
- Target http://federal-gov.be
- Sample261007-k9fw8awsbx
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2580 msedge.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{43AA41C6-6635-4FEC-BDA2-E58DCAF08E04} msedge.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5040 msedge.exe 5040 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe - Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 1216 wrote to memory of 2652 1216 msedge.exe 86 PID 1216 wrote to memory of 2580 1216 msedge.exe 87 PID 1216 wrote to memory of 4540 1216 msedge.exe 88 PID 1216 wrote to memory of 4540 1216 msedge.exe 88 PID 1216 wrote to memory of 4540 1216 msedge.exe 88 PID 1216 wrote to memory of 4184 1216 msedge.exe 90 PID 1216 wrote to memory of 4184 1216 msedge.exe 90 PID 1216 wrote to memory of 3580 1216 msedge.exe 91 PID 1216 wrote to memory of 3580 1216 msedge.exe 91 PID 1216 wrote to memory of 3580 1216 msedge.exe 91 PID 1216 wrote to memory of 1596 1216 msedge.exe 92 PID 1216 wrote to memory of 1596 1216 msedge.exe 92 PID 1216 wrote to memory of 1596 1216 msedge.exe 92 PID 1216 wrote to memory of 320 1216 msedge.exe 94 PID 1216 wrote to memory of 2408 1216 msedge.exe 95 PID 1216 wrote to memory of 320 1216 msedge.exe 94 PID 1216 wrote to memory of 320 1216 msedge.exe 94 PID 1216 wrote to memory of 2408 1216 msedge.exe 95 PID 1216 wrote to memory of 2408 1216 msedge.exe 95 PID 1216 wrote to memory of 716 1216 msedge.exe 101 PID 1216 wrote to memory of 716 1216 msedge.exe 101 PID 1216 wrote to memory of 716 1216 msedge.exe 101 PID 1216 wrote to memory of 1772 1216 msedge.exe 102 PID 1216 wrote to memory of 1772 1216 msedge.exe 102 PID 1216 wrote to memory of 5032 1216 msedge.exe 103 PID 1216 wrote to memory of 5032 1216 msedge.exe 103 PID 1216 wrote to memory of 4236 1216 msedge.exe 105 PID 1216 wrote to memory of 4568 1216 msedge.exe 115 PID 1216 wrote to memory of 552 1216 msedge.exe 116 PID 1216 wrote to memory of 1328 1216 msedge.exe 117 PID 1216 wrote to memory of 4968 1216 msedge.exe 124 PID 1216 wrote to memory of 4968 1216 msedge.exe 124 PID 1216 wrote to memory of 4744 1216 msedge.exe 125 PID 1216 wrote to memory of 4744 1216 msedge.exe 125 PID 1216 wrote to memory of 5040 1216 msedge.exe 129
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://federal-gov.be1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffa1ad6c188,0x7ffa1ad6c194,0x7ffa1ad6c1a02⤵PID:2652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1932,i,8633878852516741265,17953196203079294395,524288 --field-trial-handle=2316,i,3615892793005496985,9362208028915400707,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:32⤵
- System Time Discovery
PID:2580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1832,i,3699792244926648594,3480918989455599868,262144 --field-trial-handle=2316,i,3615892793005496985,9362208028915400707,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:22⤵PID:4540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2648,i,6142389488480438037,17268582940403535785,524288 --field-trial-handle=2316,i,3615892793005496985,9362208028915400707,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:82⤵PID:4184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,5481715489411139221,17942069200408382405,2097152 --field-trial-handle=2316,i,3615892793005496985,9362208028915400707,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:12⤵PID:3580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,10584586108818032539,1037757378460157442,2097152 --field-trial-handle=2316,i,3615892793005496985,9362208028915400707,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:12⤵PID:1596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,1073688292662073164,18266194714352033686,2097152 --field-trial-handle=2316,i,3615892793005496985,9362208028915400707,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:12⤵PID:320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,12747105759705188606,2804388244009588893,2097152 --field-trial-handle=2316,i,3615892793005496985,9362208028915400707,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:22⤵PID:2408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4972,i,7887859663653160624,13663330476189742661,2097152 --field-trial-handle=2316,i,3615892793005496985,9362208028915400707,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:12⤵PID:716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3536,i,3672321691883681520,11825536793229716868,524288 --field-trial-handle=2316,i,3615892793005496985,9362208028915400707,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:82⤵PID:1772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3532,i,3503659760635218069,8406590855084596142,524288 --field-trial-handle=2316,i,3615892793005496985,9362208028915400707,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:82⤵PID:5032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5880,i,1351466820523988838,16795310109549915202,524288 --field-trial-handle=2316,i,3615892793005496985,9362208028915400707,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:82⤵PID:1372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5880,i,1351466820523988838,16795310109549915202,524288 --field-trial-handle=2316,i,3615892793005496985,9362208028915400707,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:82⤵PID:4236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5092,i,7232010081062265519,4090293039128337474,524288 --field-trial-handle=2316,i,3615892793005496985,9362208028915400707,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:82⤵PID:4568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4252,i,14440948727207460005,3334955448377975944,524288 --field-trial-handle=2316,i,3615892793005496985,9362208028915400707,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:82⤵PID:552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4496,i,11375412673444853341,2954847351784432456,524288 --field-trial-handle=2316,i,3615892793005496985,9362208028915400707,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:82⤵PID:1328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1044,i,16273073827002846121,7775235938015598445,524288 --field-trial-handle=2316,i,3615892793005496985,9362208028915400707,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:82⤵PID:4968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6344,i,7932193561751431883,4970332542538218909,524288 --field-trial-handle=2316,i,3615892793005496985,9362208028915400707,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:82⤵PID:4744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1276,i,1644687082884277319,16560526641932355863,262144 --field-trial-handle=2316,i,3615892793005496985,9362208028915400707,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:3940
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0fa4cfc9-98fc-4291-9fdd-4f35a5c27cf1.tmp
- Size 18KB
- SHA256 a5dd2b6c82c934c67b52c3aa3350515a5233f458b0ab4db89f5ad2786a6508b1
- MD5 5e02a34908f5b1c1cc7a4d1ff79e19c2
- SHA1 6cadd2a60e8445f0f7604be95a63f4f17ab53772
- SHA512 a1192ed3078977262c7eaf3bd27ac2890fb484ff51f88801bf0cef05bbaf79e8e8cb775f10770c8cc4bbdc3643993330fabc59c3583e03a250fddddd8d395d87
- SSDEEP 384:QZcIhsNF01r5v3GJqBGYX5EKKO/v73PJAxJ+eChFoo:uh3rWEGYuKKOr3PkJ+eC3z
- TLSH T151827E729CB8BC7658E7A552F54739034FF89027E7C46B84D5EC6F1C01DA298130AD2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\91bab93f-a86a-4a21-9fb0-36fdcddfad4d.tmp
- Size 8KB
- SHA256 a7ee57a6c27ac3f71a2212bfb479fdb10cc78b8793cc51610b9e32512fa54a34
- MD5 8e5168e8ce0a83dae41eb7aba91f5ca9
- SHA1 15ac61ecef01f09716f05b79bf61aede0a5a55d9
- SHA512 6943099bd2f7196538d9a464f1abc72ec9866ad9f278ab5c454b42ce3457578a16bee3766c81c6a5ea4e17b63c053a6f81da4537f61900089ab9458d938b0f24
- SSDEEP 192:LJONo6Dph0qQmiUyEFL2wGYX59ezDCIRY6O/eeFPkIIDq5OU6:lONo61zHF2wGYX5EKKO/vY3U6
- TLSH T1B312093598B8BC7B5DD3A951B48735135FA8512BDB847F80D6EC2E1C01DF29C130A92A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\0ac15221-26c8-49e0-83b6-48f6b2cf81d1.tmp
- Size 105KB
- SHA256 10bf49f629ba90a1161d0117602435d1a511d1f7a5e47b20fe3a693551550e5a
- MD5 71eab00578b8a3050d0ce445655db7b7
- SHA1 5d8b06f8805760a18e17cebb8bf5d7f5043e6b1b
- SHA512 be43de9b4dd545f3d61990b5e57cf08e702bc1c9f282e5e78b4586dfb34cb8ef3bc6ed1dfaeab69e5117101a833b785cd1e7e844338056be3018d33e6c4afa51
- SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7P:fwUQC5VwBIiElEd2K57P7P
- TLSH T1A7B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 27f6aa5d39c98b4843eaed7972cf93d10e75e08f497afafa54ccf4057f6d52c9
- MD5 a91eafa1aeb7b35d5c7abac6d2c83384
- SHA1 a76b97105496dbfe28857282f5b661789a032b25
- SHA512 4bebba8a121156a8e7e31bb49955c0375f1ca3be7dcd3c9b113d261a4618ecdf6781fce438d8e56020e438286e1619d3844f48e91b2b2c3cbb4a55d4c199972a
- TLSH T17AD02B24C9E41E90D0131434002241453F8CC03858023012D0B812AE15419D60A21020
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 24c133ed61416156a3d0b4fa00bfca479eb7ecb5184955e998fbedcca605f8b1
- MD5 b90ecf74a561822627982f1b8d4c4873
- SHA1 3340a2b49ee7948da3345fd34ecb2ab68420b586
- SHA512 eb4373bf9ed3d7960d90950f6ae991a5e15a049a12d096bc176bd999a7c117e37d44210634cdfb6f388be8a9ac75d4920be8d0f0c23e0873f2a14b925d350604
- TLSH T1BBD08025C9F46FD5E037103D012241447ECC95665B023116E169156E19955D71E61891
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 0e364ae2365b95ee5142a1a0abe3ee5065b85c554bc5cb9fcb1f31bcd0a1af4e
- MD5 75bc6f9debcf49d2312740dfba56733a
- SHA1 af0f5dfe4b330cf62c24c0003f6c57159b23e268
- SHA512 c0a6cf9272c224460d1e7d25cf8159aa43733ebfb5f2761293ec6a5f2b4d71e061daa60092335856322f566a072c79184d7ad45d2b04b7cf8f3628e3a4bd4d35
- TLSH T176D02B2489E41E90D4131434002141453F8CC03858027113D0B812AE05429D60A21020
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\09396fc8-d9fd-48c0-b75b-a75f69964b95.tmp
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6ce04ff2-9873-47f0-92b4-32dbdd82d898.tmp
- Size 10KB
- SHA256 00eab5a247b3daff1188171cf37c9481603bcb222c9ff91dcfe215a01925792b
- MD5 510b606c0d7bd34a1b67d33249b141d7
- SHA1 7496a16ded3e4bbcb27f799776a66bd4fc729796
- SHA512 7f1157db12c2699abba23a50d127a47a9dc2f72e4c4ec47cc98905f23f55090213166e2b711a03e776fb631bd3524958a6151093de2c5d8249756e5f995c0524
- SSDEEP 192:sxZjRgWd/fCsMmM0IdpIJHW6+WNX+tXYgOoUIg54J:sxZjZd/fCsGt4HbIX66
- TLSH T11D22B7166E34A97B8CCBD20DBA15BF53E6F9503261D51E88AAFC861C05E76DD230780F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
- Size 331B
- SHA256 e454f3df5cd450a5872d6d00a7d7ea5de4367a096d999029cca8b2c21fe59d5d
- MD5 190dbb7b3e64f4bb96acbfc4009af454
- SHA1 6045338104ff3adfa87a5778ef883d627cf2a92a
- SHA512 78ebae7fe49454eded89fb02696ee53616896023b47891b4f95d14cebc699c311eb7914e8b06669a50f3d0cb38bd0792a0d474c65eb3b97f6e2cc326d29f8802
- TLSH T130E020DC55C4C21F5154648753B5A34D87C2369FD2C46A5D1704C5887547D447FC15A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
- Size 3KB
- SHA256 6a020375bb782c52aebe81f35f98fe9c46261940eb5606fd3e1cd48bc8632f8a
- MD5 a86c4b1e000d8bee7e3b2c92adade3f1
- SHA1 33d6823dc7e14b224a80badba3bbf650c2003650
- SHA512 6b4f61a374754b324f04a3c5e1130e2c0dbcbf59d7d326bcc20819d8f254f5d1ea256d00cd08ebbee6b47f31b962176c92535d5408964f84516cc398eeb79f7d
- TLSH T1AF61618116868C9BEF7874BEA3D4CCCB33B055B2E0C38D1905A4CAF8EB62F2B9050494
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 79b56d26f6bc8fdb669f5781857b1d8e1531b67b441b7770cf03e18289e6f79b
- MD5 ebd5778673f2dc0205a5d1cb18198aac
- SHA1 89b2719c4a2257bbef0a3d9e7dd90e0d87dbf441
- SHA512 cec02ca3b216c53547dd9c1a937bd3ac1006174d2b6f57051e6f64aa8ed77bf1d2a0275d4d977069d94d9121ef9a1c5fc02701417b8294a505a8353916239ec6
- TLSH T1A7614E8516868D5AEF7470BCA3D5CDCB33F055B6E5C39D1A0168CAF8EB62F2B90050D4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\8615c197-3fba-457e-a98e-a55ad04b96e5.tmp
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0f0db7fe-bf80-41b6-86dd-4b6bcc9b2bf0.tmp
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f0abe27d-aa27-4018-8967-b5ba492b00fc.tmp
- Size 2KB
- SHA256 1bde553c59d4579774a3fb5049e6fbda00afd75a04da11d567ba4ba907ed9e2c
- MD5 be66d4938addbfd666712dfd3f2b674f
- SHA1 99dadb152f4934eac386f0536241d3ad1ef34fcb
- SHA512 b8045ab3ce58b917d947e78d7477385b126d193cae7894014433c20719077f97c2b13a39a3631d1c7735b558e0c78b5a96c34544311d1b0edf8269e2b04ba8a3
- TLSH T10C519EF3C6D4862E99115AF1A7146D1BCF1E451956283D1EC8E4DF8FA3D28B1E201A4E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 4KB
- SHA256 08a4f0c89d5f4a2d562cc26d36c7f68aa82d86a3ac466ce2de34af112a82fd72
- MD5 dfda4cf4ff606d3a1e50ae6d3b5c961a
- SHA1 d42fb3016d9cfde9042269eb565e12fd2f106865
- SHA512 7ac84671e8427fd7b9a8a963ce956c26e855db0fcbacd9e396c5070d9ef6b9ee21f14101bae9074b53ef7cb5d8064818782379eefab4c6c0d1f58089d47130b8
- SSDEEP 48:K010JF3jXYbLuLISdYK991vYxdIY+vF1yLnDnmnHnjnNnln1n2bnlnon9ISnjn23:KkKEKT6qSsoKJiqT2KwcqN
- TLSH T114917E5171BE4250787E6A8D41B6862A424230F23268E52FBFBC41A74E7EE045DFE9C8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c2fe03b4-18d1-4957-9f85-7b8aac9aaa57.tmp
- Size 10KB
- SHA256 2cb550d84f6298a7145114e2e7723b144f5b078e8cce4342ca29d45ac49de968
- MD5 098ff09cd980875c21b641ea34f176fc
- SHA1 48b760787886f0c555c624983be7f39de9db4e81
- SHA512 f2fe67043746cfa7753882b2ca50ec4bcac03f81f8a59dd9e1dcf77cc4be92ca4bb08a353ac31ed24cdac30544eedfa45cae81afd49af6d4bb8d35ea5587e6fe
- SSDEEP 192:sxZjRgWd/fCsfM0IdpIJHW6+WNXOe/YgqoUIgrJ:sxZjZd/fCs0t4HbL/K9
- TLSH T13222B7166E34A97B8CCBD20EBA15BF53E5F9103261D51E88AAFC861C05E76DD130780F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c42140bd-251e-4baf-a0d1-8a058684d435.tmp
- Size 27KB
- SHA256 45afb73c46cf706694c6b0558597b16176d0d09fbcb20af46620191c1fdc8e6e
- MD5 c1780b8ee07e4b0b4d4dd1c9fbcd3aa1
- SHA1 1d7dee11eba218d4e20ed1299b4aacc4aa286ca0
- SHA512 c9312e755e244cb94e2a9f694d74e14bdc73d736e30e73e1e88690536f73d9b0899ac46ddc02fd0c2f327f2d6197b616f5b0ef1dcf6b10224e42160fe85d7deb
- SSDEEP 768:pWichfPWvPZhl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzeroSpO:pWichfPWvPZhlu1jan+LKgz1mO
- TLSH T103C2EA7B640CCA7E4FC01A9DDD1A6FDA7EA802C7A6588D4047FA984C02C77EE51264DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cfad3ce1-1cdd-437c-a146-69f64f24561d.tmp
- Size 10KB
- SHA256 8515c97a657149de295be53b257fce7cf504156b2bfddd162e9d0167d299f6ba
- MD5 a5a6d952b8e3ba05b2082b01c21b31b1
- SHA1 f014f4ca518428275afd7c5fdce7c131f4d7bcf7
- SHA512 eb9667c61c5c566646993067e0be2acd7acd09d6f3e06a5c31fe50170e3b50464ce5c10fa057055535aa5e9589c99fdb0c09a209e56e1af1db3cf4ac63f8eefc
- SSDEEP 192:sxZjRgWd/fCsMqM0IdpIJHW6+WNX+tXYg+oUIg5aJ:sxZjZd/fCs+t4HbIX2I
- TLSH T1B022B8166E34A97B8CCBD20DBA15BF53E6F9503261D11E88AAFC861C05E76DD230780F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d8fd4be8-ec53-4dd4-97a5-7059b956f16f.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ecbd27b6-da96-491f-b98a-fcdccfe85ca1.tmp
- Size 10KB
- SHA256 ac72ca3752c7d32871e9fa0a67a872b9ca2eb5b28262633ed57c26f267c966f8
- MD5 9d408ac58580a90cf98af34b9241c804
- SHA1 11c9a689962cc88fed26930cbe09b010c4e849d0
- SHA512 a0c76556fd25598fb98e546a1504494478d53828d3989534fcb30f134cd2278e666a1239c50569216ee3c7712515d01084505066f6822073e92bd9d1aeb3b0dc
- SSDEEP 192:sxZjRgWd/fCsMqM0IdpGJHW6+WNX+tXYgWoUIg5aJ:sxZjZd/fCs+taHbIX+I
- TLSH T1CF22A7566D34A97B8CCBD20DBA15BF53E6F9503261D11E88AAFC861C05E76DD230780F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
- Size 3KB
- SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
- MD5 904e6e94a1d46374c8630cfd86cc729f
- SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
- SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
- TLSH T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ae3c00c0-db1d-4172-b2ac-a3fddb591edc.tmp
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b5f7bf50-271b-48a5-888d-875ce97d7f8e.tmp
- Size 8KB
- SHA256 b952683b8aec1b10dee6e1bea216b0d72a37d75c5e977855d3631fad3b16c9d5
- MD5 dbcd26a07047f1cd96e11b6b1dbe00a8
- SHA1 0576cd5ad300a038bc2bab4ecc8f0bb04f3e0442
- SHA512 72e09bbf0643294a40ebd5500e102dc6c98648fca00ea87640b4ec0642833f6f1a6cbc95950faf33a71348082eed6e79f5987edff474b37244012ff7a4b4ecc8
- SSDEEP 192:LJONrh6DphmqQmiUyALq8wGYX59ezDCIRY6Kkk7tlU6:lONrh619vRwGYX5EKKEnU6
- TLSH T11F02EA35E8787C7B4DE3AE45B5872A135FE8112FAA912F84D6E81E1C00D768C1307937
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b621b877-e9c3-4398-923a-2959f9481404.tmp
- Size 18KB
- SHA256 63a8ca7b0076619ea988c4e440c39890668a137d73ffc5b5373b5dcbdf60ef76
- MD5 348d167eadb9649d03824d371b2eed89
- SHA1 c71a8e5ddea8aaafc6c0703af42aa4349abd03b2
- SHA512 360f449505f6269bc745debb599ca3aa67672747cc45295f94638a93e5680bc97279686ba337ad706b82ba253025566117f1ee4e95c531c0f0c1b9a67119e549
- SSDEEP 384:PZcIhsNFx1r5v3GJqBGYX5EKKO/v73PJAxJ+eChFoo:HhyrWEGYuKKOr3PkJ+eC3z
- TLSH T108827D729CB8BC7658E7A552F54739034FF8902BE7C46F84D6EC6F1C01DA698130B92A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e7c70f51-7098-48a5-a432-5a6abf7eeab5.tmp
- Size 26KB
- SHA256 f3b304900278a53416d17b459f2b07fa3731abd910b30c0f250f235cb790961b
- MD5 12d2f064dfff3fb5a11b7085637e0752
- SHA1 79a6f20f79b055fd79dbd1a4eedc7668c5d136b8
- SHA512 80e9368a1562e63acd88d907e0beb7c26121ef4f3452732f7011707706104b3b89abdc85120f8818237733fd02687d95ce0d6ac068d58c6cd66bd403f2861ddf
- SSDEEP 384:EiFiZcI4zsNf8TUNTUlIlx1r5v3GJqBGYX5EKKO/vz3PJAxJ+eChFoo:fFQEiwg5r6EGYuKKOj3PkJ+eC3z
- TLSH T129C23CF248E7987AD8AE5743A77E2D034EBCC027B6846A54B7D85A1CCC961BFC306C15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1b41d6b3-f797-477d-b723-0e6c7b6ef56a.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 0d6bad1ffebb6607969b0f91dddc4acc4d01534baf59689f04f5f066d6c1482f
- MD5 abefee0b408c2c34b422ad503223b472
- SHA1 fff4997cb55f61f4fb240dd75b68d0010aad3d49
- SHA512 c7a79b7e61addc30e285f4239cb395a8d1b707b81b809cfcbe7dee93e1bcf948438691cd6cb003c04a37268d04456bf948727698ab395988744360c3a6e98d4e
- TLSH T1B641E75CA6F91108B3B76F5AABF7696D447BBC773E06855D10110E8F0A62B00C8B2B37
- MD5 SHA1 SHA512 TLSH