Analysis
- user interaction
yes - max time kernel
149s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/10/2026, 19:21
Static task
static1
Behavioral task
behavioral1
Sample
exec.html
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
exec.html
Resource
win11ltsc2024-20260911-en
9 signatures
150 seconds
General
- Target exec.html
- Size 12KB
- Sample261022-x219eahv5n
- SHA256 da9f6e23a026954309fd9067fea6f5f38541998967b92c409a9d4a4ebd478b43
- MD5 d24e4b192638fd5f5c4279155a5e0d97
- SHA1 fea46932dd24f1fa0d0297d3b2fc45ae90dcba2d
- SHA512 84ab22e04cb350c24667e948ed8b7d22778bb8a20ad45d088628b490fdd0806228ed72d2ee85676c8e59509b00fc9f7b21d474eb2f96fdfd4b813c5690701a23
- SSDEEP 192:Pj0UFE9zxweJjeJtj3dMiUH+ax8rwiXSNy9T0VI:AyExxweJjeJxdXUHP2rrSMN0VI
- TLSH T19442B3C7BA71C0F237152D77606F09299168F5869830F7D0F6ADD3E1A7A5360C6A8B1C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 5092 msedge.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{F8D8A8B3-F1A7-4ED8-B06E-CABA6F6EB6E3} msedge.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4132 msedge.exe 4132 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe - Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 2092 wrote to memory of 2968 2092 msedge.exe 85 PID 2092 wrote to memory of 5092 2092 msedge.exe 86 PID 2092 wrote to memory of 3560 2092 msedge.exe 87 PID 2092 wrote to memory of 3560 2092 msedge.exe 87 PID 2092 wrote to memory of 3560 2092 msedge.exe 87 PID 2092 wrote to memory of 4568 2092 msedge.exe 88 PID 2092 wrote to memory of 4568 2092 msedge.exe 88 PID 2092 wrote to memory of 1764 2092 msedge.exe 89 PID 2092 wrote to memory of 1764 2092 msedge.exe 89 PID 2092 wrote to memory of 1764 2092 msedge.exe 89 PID 2092 wrote to memory of 2268 2092 msedge.exe 90 PID 2092 wrote to memory of 2268 2092 msedge.exe 90 PID 2092 wrote to memory of 2268 2092 msedge.exe 90 PID 2092 wrote to memory of 1104 2092 msedge.exe 92 PID 2092 wrote to memory of 1104 2092 msedge.exe 92 PID 2092 wrote to memory of 1104 2092 msedge.exe 92 PID 2092 wrote to memory of 3824 2092 msedge.exe 93 PID 2092 wrote to memory of 3824 2092 msedge.exe 93 PID 2092 wrote to memory of 3824 2092 msedge.exe 93 PID 2092 wrote to memory of 1256 2092 msedge.exe 97 PID 2092 wrote to memory of 1256 2092 msedge.exe 97 PID 2092 wrote to memory of 1256 2092 msedge.exe 97 PID 2092 wrote to memory of 1688 2092 msedge.exe 100 PID 2092 wrote to memory of 1684 2092 msedge.exe 101 PID 2092 wrote to memory of 1688 2092 msedge.exe 100 PID 2092 wrote to memory of 1684 2092 msedge.exe 101 PID 2092 wrote to memory of 2504 2092 msedge.exe 103 PID 2092 wrote to memory of 2684 2092 msedge.exe 110 PID 2092 wrote to memory of 1948 2092 msedge.exe 111 PID 2092 wrote to memory of 1616 2092 msedge.exe 112 PID 2092 wrote to memory of 3192 2092 msedge.exe 114 PID 2092 wrote to memory of 3192 2092 msedge.exe 114 PID 2092 wrote to memory of 4576 2092 msedge.exe 115 PID 2092 wrote to memory of 4576 2092 msedge.exe 115 PID 2092 wrote to memory of 5008 2092 msedge.exe 116 PID 2092 wrote to memory of 5008 2092 msedge.exe 116 PID 2092 wrote to memory of 4132 2092 msedge.exe 117
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\exec.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7fffce4dc188,0x7fffce4dc194,0x7fffce4dc1a02⤵PID:2968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,14529206459050812705,10675776371253653288,524288 --field-trial-handle=2256,i,18340381839700233561,7921469872668029146,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:32⤵
- System Time Discovery
PID:5092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,8739367555301945843,4279291175457747862,262144 --field-trial-handle=2256,i,18340381839700233561,7921469872668029146,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:22⤵PID:3560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,11690649098241178566,10576128031579077744,524288 --field-trial-handle=2256,i,18340381839700233561,7921469872668029146,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:82⤵PID:4568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,486292110066479296,3686513887100705205,2097152 --field-trial-handle=2256,i,18340381839700233561,7921469872668029146,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:12⤵PID:1764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,5361427932680925249,3586012808610508246,2097152 --field-trial-handle=2256,i,18340381839700233561,7921469872668029146,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:12⤵PID:2268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,8610985788159046278,12615241816620282119,2097152 --field-trial-handle=2256,i,18340381839700233561,7921469872668029146,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:12⤵PID:1104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,17883573354643831507,9041922862059162255,2097152 --field-trial-handle=2256,i,18340381839700233561,7921469872668029146,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:22⤵PID:3824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5060,i,11825758961217733641,13657365668560349212,2097152 --field-trial-handle=2256,i,18340381839700233561,7921469872668029146,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:12⤵PID:1256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,5927734226098638310,12188420540823047498,524288 --field-trial-handle=2256,i,18340381839700233561,7921469872668029146,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:82⤵PID:1688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,3008810148417725089,11261516312566684682,524288 --field-trial-handle=2256,i,18340381839700233561,7921469872668029146,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:82⤵PID:1684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,17239452790240229823,3316997000390170428,524288 --field-trial-handle=2256,i,18340381839700233561,7921469872668029146,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:82⤵PID:5084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,17239452790240229823,3316997000390170428,524288 --field-trial-handle=2256,i,18340381839700233561,7921469872668029146,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:82⤵PID:2504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,12399987341745913707,2133524413586692100,524288 --field-trial-handle=2256,i,18340381839700233561,7921469872668029146,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:82⤵PID:2684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,10835784180224538671,16768943707062770078,524288 --field-trial-handle=2256,i,18340381839700233561,7921469872668029146,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:82⤵PID:1948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,18331597155740778586,2907243313781274994,524288 --field-trial-handle=2256,i,18340381839700233561,7921469872668029146,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:82⤵PID:1616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,12207561444839487712,6148479567338012399,524288 --field-trial-handle=2256,i,18340381839700233561,7921469872668029146,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:82⤵PID:3192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,10642967740544618475,17117885762065210279,524288 --field-trial-handle=2256,i,18340381839700233561,7921469872668029146,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:82⤵PID:4576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2124,i,16245031598526521068,4770974185732155893,524288 --field-trial-handle=2256,i,18340381839700233561,7921469872668029146,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:82⤵PID:5008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6316,i,16201234269637589526,2676801548594267280,262144 --field-trial-handle=2256,i,18340381839700233561,7921469872668029146,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:1160
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1f90accf-c7f8-4703-a173-39c308af33e4.tmp
- Size 8KB
- SHA256 f7dd57f1938b123057c68173a037d8c9bf580219b52e43ff6f13bf318ff80540
- MD5 cdd324f6e72d757ffed317298d90d3a2
- SHA1 71b8c68ece1c68688e7a54a9c930362dfa8a29d3
- SHA512 7b575349ec15103b0cea54f15279d3335599790b38d7a54e72549ffdc53d271e6a4bfc2a98b71e4a34c92e04188de865e2922dd3e383e6550b1fdd4045e88279
- SSDEEP 192:oJONR6nnH9QmiUyz5IYcX5hQDP1UjzorA1WpXRqlRg3vrq5/U6:uONR6nbgINX5+DtE8A1WpXM8g/U6
- TLSH T11E120C36E978EC6B5ED2A586B0873113AEA55127E6487FC0D6EC2B1C01EE66C530DD23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\325dfa95-80d0-4571-9fa3-ae30ab8348ee.tmp
- Size 21KB
- SHA256 687b9f125bbe5c6de4b8a68c9c5ec49d20c38c20b82c40417ce9bd0fea679803
- MD5 99202cfabf7445419e07ac998898204c
- SHA1 cd3e90652e187fb27494e806321e3c7e3fd77ec9
- SHA512 f0fcd40dc25da22a015c63da54f792d7716d904c7c64eed90e0e459ff90019c6edcf91434e61699c6ebdc50f6c3337dad8eb9e54a95907a4b223cee15e70d9ee
- SSDEEP 384:dViFzQkUSvSzsNg8TUNTUlIlKhiki4QX5+DtE8A1WpXMVg/vwQTBIIlz:dcFd65wgiGrkDr+g/vxL9
- TLSH T14FA25B336CA8ED7F9EE6AA85F15A3103EEB05167C6856FD0E7DC6A1C019A1DC230BD11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3760c67a-2906-461d-8266-26f3321a87fd.tmp
- Size 8KB
- SHA256 4ac4d08ade447008a85e70a17b289f931d824cdf6ef29a8e310fc25facd27e90
- MD5 2a22a4162c13550f44dc32b8319844a0
- SHA1 96e5f959ea67910799482d0b73da71ab1148255f
- SHA512 49e1aab0e58ee5c12765a8d812106a32051680483bf511870aa0d88ee6bd1b4c30e683f427d8eb06bd9ffc0dff8c9f755a6e96530d1639104a5f32ded5913d13
- SSDEEP 192:EON76nnHGQmiUyB5QYcX5hQDP1UjzorA1WXMcHGU6:EON76nCUQNX5+DtE8A1WLmU6
- TLSH T13402DB35EC787C7B8EF3AE46B0863313AF952167A5946BC0DAE81E1D00D765C230A923
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\6bd18ea9-331c-4392-ad73-e76312ab448c.tmp
- Size 105KB
- SHA256 d94841acc41ca658a5ee48a1ef8763d968ff86dec9b648ab9d4d5f3d4fea0d3a
- MD5 3ec4eb6dbe24df0552b56af18c05a2b9
- SHA1 fd334aef86650c95ae106374f1bb923cd2432390
- SHA512 44bb44d7dffcecb78e155155b9571e4c572f63ed79c2a0c69cf356c04a91ff7d4cca3351e2c6a641095a4fbe0d38498ae9c3f0ebaf029b3ba42f1da7597e026e
- SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
- TLSH T1B6B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 c1d24032e322bda4aa4f943eeee5c1be2eee903b8fa00c6e40c3ae3aab1d6e57
- MD5 cf18b86051311e5d4cb3435637b32441
- SHA1 81808c10d3ea99d837ac73ca978bbac4af2b14c3
- SHA512 d8f6d4f7cc0a9a322acccdf645cd0eaf7d236c68d82f2fd25c2d01e1e6ce323c3d584edd204b1c68ced260f3cf67a5be22a62de64511401735df9213129ac8f0
- TLSH T1EFD02B02FE898A6CD4921C34012E811D36CDF40049027041C0B023974C04701102CC64
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 7ba460c9f5a00478279781ba3317975fb747ea7519f30b24bac67a94df77c22d
- MD5 be02dc26a22f37196d8a2ed1f90604b5
- SHA1 0d4f49e0f6b152530b0ff133dac678914194c470
- SHA512 74fcddf19d34dc2b1dc8ec59c0f57f326e68c7c9b62fb89494b07e2bd52522d6f7662a05f91a2d0787fba43ac2646fc3214bc591a45f14862aa715bcd9206f88
- TLSH T1EBD02B02FEC98E6CD8921C34012D811D36CDF4004902B142C0B023974C05741102CC64
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0bf32b48-9aff-4b46-bcfe-9b1c4b969406.tmp
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\316b4aab-80d2-4476-ade8-4aa5bd0ff97a.tmp
- Size 9KB
- SHA256 b364484acbae9441edeccb945f4aa86b1f1ed9f9212f402a9f79ff94a007fd2b
- MD5 8ad2b129045e09b69fb268fccd537aeb
- SHA1 4bb0137a40e9768a312d88ababa2a17ccf3f9e37
- SHA512 b46c7175e3ecad458bf94b68f5c50d6a72320f96264f53253fb722d5cea97305496c6c57d947201b3471520fa32c871e04888bf1a14cb4d95a38c4a2bca803b3
- SSDEEP 192:sxZMRWWA/fpsbBIdpdkHW6+WNGYYBahg2Ig5lJ:sxZM3A/fpsbqeHbGfqx
- TLSH T1E522A7526E28A97B8CC7E20DBB55BF13E6F9503251941E48AAFC861C05E7ADD220780F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5cea12a9-24da-44a0-82a9-d517e818a592.tmp
- Size 9KB
- SHA256 ef5ef11d333ca175088ef4a5be8f2a89cdc64a0ee473efff06e21710cd0a7be6
- MD5 f9d5a56000753b422739d46f5392bda8
- SHA1 87a31b9b783ae5245ba475f02dfc92c2bd8adcc9
- SHA512 2c8fd3dbdc394704cfd30e5f51d3702623fd82639f7bea61fc16e4bbad39324b92310ff52b72f5a788a90afcc08e0d5c91833a5249a124b7ce168da17eba919d
- SSDEEP 192:sxZMRWWA/fpskBIdpdkHW6+WNGYYB15g2IgrJ:sxZM3A/fpskqeHbGfh9
- TLSH T13412A7126E38A97B8CC7E20DBB55BF53E6F9503261941E58EAFC861C05E66DD220780F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
- Size 331B
- SHA256 c320e47c9da1a8d204f3c77afc081e36dde09ea908c138d1c767ab7b8dd09090
- MD5 4ec866f31a748623ebc390418c0cb8e0
- SHA1 1645750006e3c90fcfe880c858674d756e5272d9
- SHA512 917b84b58536ccc3a398239b496b08bc31ad5cdb0bfa56f7cd8fee59975fafa8e863bbb98f6557356f20b9b44cb79fcea775b8a6e54b850f0f64c72bba72fbfa
- TLSH T1AFE0268814EEC33FA628649701BC430C8B80A71BA3C06BBE2701CA86B405880B6C6AF0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
- Size 331B
- SHA256 cfe9b7dc7bb03076d7cf15d28992628d4e6fbb6462d6490d9aabf8564a4d0c34
- MD5 beb411a3b4df2752e87b691b65cbea4c
- SHA1 1a187937d8f21209897002cd43d75a6510352f38
- SHA512 b392c19c83066c123b3901487b453a5a55eede3ce64f5514782c76af951f4abd867c0ad6677c668dee802e41e38f86443b2a297d36042638bf05d9e4c90b1995
- TLSH T1C8E0268406C8C33EB788A45702EC930CC382272BB3C07DAE1F0CC686B405880B286AB0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
- Size 3KB
- SHA256 ab6774b91f0405d7d9df43c3f09981c201ec5c92bdf71fa686952b07baa14d7a
- MD5 8c7f8655102718d42553b24ed36bb273
- SHA1 8b1555779b47f663c25d1b13229ebb4b7b68231c
- SHA512 0db42da0091a5f9a35dbb91043b5a2efe0b24bbdea8b1f44803b058feaa18fd91c0db2f87cb2ce7f08793f2e7316b69dd4a6ba55d48cc8fdf2b465d404760ab4
- TLSH T14E61978257934C90FF9885BCE1C5258B3AB0E48B9FAB9E5F0DB4C8BB5936314D51F090
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 2aadfac379783b014eb0b86298d0171bc20ff052b76c07995f47a4a68ad8e150
- MD5 45be036b308633d4f88e602997152637
- SHA1 9a0f17b397449adf3717f147ff2237f02a33d6e7
- SHA512 d4808b874dd88f9f9c5c9c59dc29a90389b29dd16568ef58760c2cc6e58ae23bd7d80a60853c89a9619c97c9a2204ec35bbd7590cacf1e5fe63d58c9ef2af653
- TLSH T12B61978257934C90FF9885BCE1C5158B39B0E48B5FAB9E5F0DB8C87B5936714D51F090
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\065506b8-c978-4f28-b224-b40d532c6b4c.tmp
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\44de8756-ef3d-46e8-b367-277fe9294769.tmp
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a817957e-2a1c-4068-9973-6cfaad86ea13.tmp
- Size 1KB
- SHA256 d68df908309448b2ac4231b8f255fd44ee7e80ff587cd81fbdfcb1d037171e61
- MD5 e3a93f9a8ea8cc9e237e21b63fd71ad2
- SHA1 afcc0dbe03e57ebdf4af3d0c4fe56ae564e313a7
- SHA512 8306650a9e896a5112e571cbf28cf6bc1afdffb43c79f9e02d4dd8f46b0d38110fda25c8082f7fe703d6e76341457137404dcdfa38912a48877ea0e9e178810b
- TLSH T13441CDB7C7D8876E881152F06A24BE1BCD1D0607422C3D1A89F4EF4F93E2875D10259F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f44fda8e-31ec-4497-ae60-0889758dcca8.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 4KB
- SHA256 0b90d3e640a4f45d6a60158fcaa075a9038edf2e5e24711362e8a7b3b9c52879
- MD5 5401f822a8e10d09476f429da47feff0
- SHA1 7b53506f50b427795a15c3462d565ae08bd625ac
- SHA512 953da05152f0127eab6098002c07a0aab0905d647455ebc5c51fd67ab8fa31c85f46f44d2e279fbfe3596dfa69f457b42d2e75722944c7afa3a133a2db0e0614
- SSDEEP 48:KghwdR7/DcbvaHISpcK9J1jcxBMY6LBByL2xMwuUUNb4PgISINK9s1uNxmdYHYI0:KAmYKDKmut+KmsNb6Kckmh
- TLSH T175918350757F539538BE268882E8962B464230F735A8E57B7FBC40618E2EE045CFE9C8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ab174082-131b-4a48-9ccb-b79a0c3cbaea.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c2aa738f-6603-4898-8606-73bbf4d16a6a.tmp
- Size 27KB
- SHA256 d5dbb035506930e566fd8c96620ece8e7961e4298c402a051421d1609ccb9c92
- MD5 934940f42b200c702fb63204570d2a50
- SHA1 000c47a34e20e68ac59249cbecee7a22c06a9292
- SHA512 c0cae3ee5864c477587ceeaedff9ff1ef53a31b498642c431d1ed07994b1a4ba258e3f8348a41ac3815697fad6ba991db1060b3a20318e1ea86c415ff7343e61
- SSDEEP 768:RyyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXGroptM3:RyyYR7jWv3NpBu1ja/CL8OX9u
- TLSH T1F5C2E92B640DCB7E4FC01E9DDC5A6F9B3E9802C7A6548D4047FA954C02C77EE912A4DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cd871a61-d3b0-40be-bf9d-c03ab30cf6de.tmp
- Size 9KB
- SHA256 0777237b7ef18c2d06f0dffd6849c84c2fa8e2c79673353c286390001239027b
- MD5 37d9033f391e6ce60eeab469282fc4ea
- SHA1 e743eacdd1a5bad9ef593fc0a0288e72a8907452
- SHA512 6e0b3912b0ff8defa29ba8c7c3ef0dbcaaeceeafc91139ed208de4478841d1e0e134a1eea6bc14e681c14b8c20d5b91f74b448aff714f421bbb5dec2565f8583
- SSDEEP 192:sxZMRWWA/fpsLBIdpdkHW6+WNGYYB15g2Ig5XJ:sxZM3A/fpsLqeHbGfhv
- TLSH T10C22C7126E38A93B8CC7E30DBB55BF13E6F9503261941E48EAFC861C04E66DD220780F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f62f3eb5-82bf-44d6-a741-c9e692b046e2.tmp
- Size 10KB
- SHA256 2d80caae2e6ab70590d6a39a98a40f0cebd36fe39b06d44d71773bfb74d91bce
- MD5 da907d6e344a03669c3477de5df21a74
- SHA1 fd17d7c91b2d16c3a3f0576aca53fd35b4e17d0a
- SHA512 730b02af342368e195500923959b1bbc760551deae9fd17d3d9ceaa7ba44dba6ed0a679cc4b551ba76d53c08f56c185acd9271c103ce592b86fa9c701e31602b
- SSDEEP 192:sxZMRWWA/fpsbBIdpHkHW6+WNGYYBDeg2Ig5lJ:sxZM3A/fpsbqEHbGfUx
- TLSH T11B22B8526E38A97B8CC7E31DBB55BF13E6F9503251941E48AAFC861C05E7ADD220780F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4a51f2ba-5437-4f31-9cc8-2d2669c4ab80.tmp
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a5f404d8-3b53-4f05-a594-4bc89dcb8655.tmp
- Size 18KB
- SHA256 10910dcc372f4e05cbcb9cb861ddc25a370368d845cf0ff166dcbb5d3437ef06
- MD5 159bfdadf202eccc5023fca4d1bc06f5
- SHA1 09b32c9a1e9cfc1b148aed3800e783eaa7a30eac
- SHA512 9c446c674afa493be36b49039d522577d763c4d47a52449151034d0091ad181c81b2ef846fb2b7338c440e5547458b522db84f4cf837a5ea932c8c9d19aa4700
- SSDEEP 384:WxQkUSv0sNg1hiki4QX5+DtE8A1WpXMJg/vwQTBIIlz:Wj0/GrkDrQg/vxL9
- TLSH T107826D326C79AC7B4EE2A596B15A3143EEB49517D7C82FD0D9EC6B1C01DD29C230BD12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b4740391-ebf1-4e51-bf3f-680179546e96.tmp
- Size 18KB
- SHA256 a42876bccfc4b728412ce9f479674b5266dc8772279d260e2741726845ee6381
- MD5 bd7d91247caf20cc175d85c22191e7bf
- SHA1 136057c3a1199ba86d13dc44311d4dbe5fbdf8ae
- SHA512 2a3cacf3af11e32bda333c8373348f362a2c0b8db0e4ebf08a91fc07068230e283380b3dda86255fced35368cd9f4949b23f276daee613d369ab273abc6077b9
- SSDEEP 384:VxQkUSv0sNgKhiki4QX5+DtE8A1WpXMJg/vwQTBIIlz:Vj0sGrkDrQg/vxL9
- TLSH T140827D326C69AD7B4EE2A595B15A3143FEB49117D7C82FD0D9EC6B1C01DD29C230BD12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8b14700b-d12f-4791-8a2f-8ca2dc1bccd8.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 0c9d055b103428bafe6c219af215bbbdb0aef9f2528628b421d2a8355e3ca27f
- MD5 4258e190bfcb41c072707aa51bcea763
- SHA1 f72da7edd7bb5d3f4116428eba53a6191842a04d
- SHA512 8578059c9749d16d976b54de9ee7624fe98d75ccc59f0a17d1b3a8992b0b66cf487b6c1ea923437045f20172068b085f8d62d6da050ed74c614d6380df81894a
- TLSH T17B41489CAAE9114CB3B76E5A9BF2B86D447FB9772E16809D00610D4F0A23B41C8B1733
- MD5 SHA1 SHA512 TLSH