hxxp://aerotel[.]cl

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/06/2026, 15:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://aerotel.cl
Sample260624-tddxesdv7p

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3364	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267901831980069"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{36EBCBD7-6327-492E-9906-861FB3E1E3BA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3996	msedge.exe
3996	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 4224	4228	msedge.exe	80
PID 4228 wrote to memory of 3364	4228	msedge.exe	81
PID 4228 wrote to memory of 3452	4228	msedge.exe	82
PID 4228 wrote to memory of 3452	4228	msedge.exe	82
PID 4228 wrote to memory of 3452	4228	msedge.exe	82
PID 4228 wrote to memory of 1984	4228	msedge.exe	84
PID 4228 wrote to memory of 1984	4228	msedge.exe	84
PID 4228 wrote to memory of 3264	4228	msedge.exe	86
PID 4228 wrote to memory of 3264	4228	msedge.exe	86
PID 4228 wrote to memory of 3264	4228	msedge.exe	86
PID 4228 wrote to memory of 684	4228	msedge.exe	85
PID 4228 wrote to memory of 684	4228	msedge.exe	85
PID 4228 wrote to memory of 684	4228	msedge.exe	85
PID 4228 wrote to memory of 3304	4228	msedge.exe	89
PID 4228 wrote to memory of 4164	4228	msedge.exe	90
PID 4228 wrote to memory of 860	4228	msedge.exe	91
PID 4228 wrote to memory of 3304	4228	msedge.exe	89
PID 4228 wrote to memory of 3304	4228	msedge.exe	89
PID 4228 wrote to memory of 4164	4228	msedge.exe	90
PID 4228 wrote to memory of 4164	4228	msedge.exe	90
PID 4228 wrote to memory of 860	4228	msedge.exe	91
PID 4228 wrote to memory of 860	4228	msedge.exe	91
PID 4228 wrote to memory of 2324	4228	msedge.exe	88
PID 4228 wrote to memory of 2324	4228	msedge.exe	88
PID 4228 wrote to memory of 2324	4228	msedge.exe	88
PID 4228 wrote to memory of 3492	4228	msedge.exe	93
PID 4228 wrote to memory of 3492	4228	msedge.exe	93
PID 4228 wrote to memory of 3492	4228	msedge.exe	93
PID 4228 wrote to memory of 4940	4228	msedge.exe	94
PID 4228 wrote to memory of 4940	4228	msedge.exe	94
PID 4228 wrote to memory of 4940	4228	msedge.exe	94
PID 4228 wrote to memory of 3300	4228	msedge.exe	96
PID 4228 wrote to memory of 2816	4228	msedge.exe	95
PID 4228 wrote to memory of 3300	4228	msedge.exe	96
PID 4228 wrote to memory of 2816	4228	msedge.exe	95
PID 4228 wrote to memory of 5076	4228	msedge.exe	97
PID 4228 wrote to memory of 1564	4228	msedge.exe	99
PID 5076 wrote to memory of 748	5076	msedge.exe	100
PID 4228 wrote to memory of 792	4228	msedge.exe	101
PID 4228 wrote to memory of 4728	4228	msedge.exe	102
PID 4228 wrote to memory of 2216	4228	msedge.exe	103
PID 4228 wrote to memory of 3236	4228	msedge.exe	104
PID 4228 wrote to memory of 3236	4228	msedge.exe	104
PID 4228 wrote to memory of 3236	4228	msedge.exe	104
PID 4228 wrote to memory of 4372	4228	msedge.exe	105
PID 4228 wrote to memory of 4372	4228	msedge.exe	105
PID 4228 wrote to memory of 3996	4228	msedge.exe	107

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://aerotel.cl
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2e8,0x7ffee486c188,0x7ffee486c194,0x7ffee486c1a0
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,4219876538777969739,13422142034726630343,524288 --field-trial-handle=2196,i,6129978546579477693,996041935766777538,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,13718326368419571444,18430215767147917077,262144 --field-trial-handle=2196,i,6129978546579477693,996041935766777538,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,12696290481762822805,16778469246664728864,524288 --field-trial-handle=2196,i,6129978546579477693,996041935766777538,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:13
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,3222370369947479983,7696082059037239078,2097152 --field-trial-handle=2196,i,6129978546579477693,996041935766777538,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,4420108160280126673,6086477713930445739,2097152 --field-trial-handle=2196,i,6129978546579477693,996041935766777538,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,16922216211942840817,1144389273311914395,2097152 --field-trial-handle=2196,i,6129978546579477693,996041935766777538,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,1579311415286559671,3893698260176844778,2097152 --field-trial-handle=2196,i,6129978546579477693,996041935766777538,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:9
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4264,i,2158227493484314876,9501776960575256666,2097152 --field-trial-handle=2196,i,6129978546579477693,996041935766777538,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4316,i,8961811681271356273,14298125769851689640,2097152 --field-trial-handle=2196,i,6129978546579477693,996041935766777538,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:9
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5392,i,6616198877574787059,17460614222083070188,2097152 --field-trial-handle=2196,i,6129978546579477693,996041935766777538,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3660,i,13772101962238989683,14868122357282034036,2097152 --field-trial-handle=2196,i,6129978546579477693,996041935766777538,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,16170090190943767681,4907764804196906611,524288 --field-trial-handle=2196,i,6129978546579477693,996041935766777538,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,13692219235889250145,3989568872470122268,524288 --field-trial-handle=2196,i,6129978546579477693,996041935766777538,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,17334068019498823313,14187140134162051646,524288 --field-trial-handle=2196,i,6129978546579477693,996041935766777538,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,8241012002068300787,2267182180343749498,524288 --field-trial-handle=2196,i,6129978546579477693,996041935766777538,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,8241012002068300787,2267182180343749498,524288 --field-trial-handle=2196,i,6129978546579477693,996041935766777538,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,165584341483430229,6964943260758493131,524288 --field-trial-handle=2196,i,6129978546579477693,996041935766777538,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:14
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4684,i,13801395488847589144,1142004332151297132,524288 --field-trial-handle=2196,i,6129978546579477693,996041935766777538,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4688,i,4747429586649574022,18264934611035227550,524288 --field-trial-handle=2196,i,6129978546579477693,996041935766777538,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:14
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5684,i,2900767266300905992,14831651612755896472,2097152 --field-trial-handle=2196,i,6129978546579477693,996041935766777538,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,12913305141254942444,6221241006591804776,524288 --field-trial-handle=2196,i,6129978546579477693,996041935766777538,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:14
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=748,i,4108144512389906534,14960482921829894184,262144 --field-trial-handle=2196,i,6129978546579477693,996041935766777538,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
MD5 5de7bfd3f869f48e7255b6bdc532c4bc
SHA1 c26027eb70bc9887bf69c2b22be60226b685dbae
SHA512 0e6af8c455f57dc816a2c01366f46a0d069e8f41cccb1f7565e2afd873b71ffd5f135649fb4bf44d1a15a9efd68dc59696dc74a971b3483ec9d87a4323b2b4f2
TLSH
T112D08032FB5D6052E7455230D893DF10276644A12C974B41E325C84CD5B80D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
MD5 8c92d931ed33c3d779a020ae7e111fb4
SHA1 de123f6d92bf24747affe820aaa8be3785388fae
SHA512 5be895d6a61eacf4f3117293636fb4890abbe186ddcbfbb3c8d3aa0fd1aa59519bbdd86e552732d2ded27aae5be1ffb0d6d9f6ccaac824d1b13ed03a12a438dc
TLSH
T13BD08032BB9D6452E7455230D893DF10276644A12C978B42E325C84CD5B90D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 375KB
SHA256 431a3251deb71c9c6d19db7ece22c26583f9d8fdba96fdfbb6a5b27d4214e31f
MD5 a3e719f84f525e2c6689b3f6ac73c402
SHA1 e3e93bf2c5aa88529ea3c1e524d2350245e91515
SHA512 0816380a9e625ce2e34fef598104a90a2724096b4d627bbe790c58008eeb3c50c732aa24500caa54fdc46c7f63216533adfb46d119a74aff4ed421b9f381ddbc
SSDEEP 6144:bk02i6NJqyLQCeqg5Vici0bU4rCHA9Q9lkOmEeWxF9Mh+kLNYr7tHLh:bMNJqybeqYvxCHAmXmEevbK3Bd
TLSH
T1A4842368F4BFE4A2AE8449215E5E0D746F487EB21740540AFB7DE2BB2415C493B6F203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000aa

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000aa
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 f12d44f434523b3bf7259860af0a698bee38555f43053ef8472591b507fbecb8
MD5 6e7eb868f4614ed45e4adc62ed4611cd
SHA1 9e24f393a92d2902d929bd04ede3c74d6d808d0d
SHA512 5c0403867e9abfe94bb2b160ed31fe96ca30160e4e9d253852777faa0f16b7086206347afbd1005bb1a8e1ab8ac2dc77197188b81305ef5170c21e4a3099130c
SSDEEP 48:1/qRSLjYbJpFSTmXoRHSvnH3ury2F27Smpgb5rXTxSkkQBpg4xqpCIJa7nC2bpVf:1/4yYBXnH3+dcsXUp32bKBhjW7SAOKB
TLSH
T143A1940689A7C497FF06A5B6C0D40BC436B4415F995F5F0B4298757E2C0B7D1F7E8608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d279edd93a665bc70abd5554d3a1a6c2da5aaca49eaf73456957076a5897e9b3
MD5 ba6140f60836a45a161ac9e7190b7c58
SHA1 6a72d90ec389e41849f964e461db0c919a3469b3
SHA512 5af358ab59160592afcf95da6097534749ed178bf38cf87ab801adabf5bb1d8d91f6fd7e0bd96e449820b45fa08b80a6e37f5e6cdfdbc2f14351510c7f721e24
TLSH
T139716109D976C487EF56E1F0D0E81BD439B48089D96F2F194198747E6C0BBD2D7D8608
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588edd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588edd.TMP
Size 3KB
SHA256 766b05aca7bf70afe934ec0c957a66790b82d50cb4e48ab7debcf7ebd6d92a5b
MD5 05e2f032bb7578912c8ebf491bfe05b6
SHA1 2b5e5ac2c350ef330931009c8c67d10dc4afdca3
SHA512 b43a73ff0778d7e27f1aa7db346801d2983faa1400d38392823cbe4c855f3965ce81207c099e3db0cab061c275fe3e0fe65631f17face66f1fe56390958d3668
TLSH
T1CE715F19D972C487EF56F1F0D0E82BD838B48059D96F2F1D4194747E6C0B792CBE8A08
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 293339dc9378c464d72843c871131d8c26f16e3a883190818ad3b8f8e74aa69f
MD5 4990246153536f299ca9ac1aadd0cef5
SHA1 6b82965cf468ef97993d3814ddd7240050cb089a
SHA512 f6c888cbc5c3131f9a8ef99136b439304af77839ae811a4d4171de409b77beb418ffcc202581acb02ce03dafccd55d5eb4817370f008b04778bf7f6f33e657fc
SSDEEP 192:DNH56ViVnGeyDlaWe0ZeThA5gLvHKiR3rmOrCPPGZIDbuuUO8EvVTtHBRwGdv+N/:DNH56ViVnGeyDlaWe0ZeThA5gLvHKiRn
TLSH
T1C22283A7C3D4853DDC1661F06A24EE2FCE29451463643C36C9EDAF4EA3E9471F111A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 59b8167c53169f52c269ff7d386cc3175466c16816d65a8a50356475f0a79e30
MD5 290b4740491551911fae8162be480984
SHA1 82436b4d0e55f6d7e7ecfb5c82aad80ece4130a6
SHA512 0c70e5703db4b693f29ac5d6dc2f264fc88e8d3cfecddd1dfd412fb1f0b6b13c60d5fb967791f8bbe7d7023f312f0eb07cfc6fccbe4ee05cd172552bc9274553
SSDEEP 192:sxZOR2yM/jK1Ml8UQQFJ/fBslp05IdpHQ/W6+WN7fMZY0oqkpTUcIg5SJ:sxZOgqGJ/fBsP0Sw/bQZ5JAM
TLSH
T17152D8166A389977CCDBD209F945BF53DAF50572A2900E48EAFCCA0C04E6BDD621781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0200b910036a538a5aa208383f96da07ece790f0e63407bed9ef7784be2eb749
MD5 a5be28e3baf312c21f4e0ab7350248e9
SHA1 2d5ef282a6e41692104d8445e5b216da0184866e
SHA512 323772d109cf89d2ebcda774419825b4d8b7749ee9c8fbf74da101ae2c16e4dc5873b2680a1a5a5ae88a2b70ad578d197e321d979496d82267c4920659f39e69
SSDEEP 192:sxZHR2yM/jK1Ml8MFJ/fBshp8qIdplB/W6+WN7Os/Y0oqVa7UcIgrJ:sxZHgdJ/fBsj8jD/b1/53A9
TLSH
T17052E8166B389977CCCBD209FA55BB93D6F90572A6900D44E9FCCA0C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 737d96327d80a848a6180c11cf9ba94f8c5348c8ce697453ee4631d2824dd676
MD5 4fbeb6713092f78250ccc4b7832f5abb
SHA1 6967c79b2d448dfea7fffc080db68a2095c11592
SHA512 8aaa91338f9c6d08cecd7c22bbb33549f4785adf556819c000dcaac218d43351e70d8be6bf3ed3c85536a8e12962a8d21b211023d9c7905f20fc53f473abde9c
SSDEEP 192:sxZOR2yM/jK1Ml8MFJ/fBslp05IdplQ/W6+WN7fMZY0oq8a7UcIg5SJ:sxZOgdJ/fBsP0SC/bQZ5aAM
TLSH
T10252D8166A389977CCDBD209F945BF53DAF50572A2500E48AAFCCA0C04E6BDD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 22e19c141eb043f99b49dbfcaa4454ada10f3d2e9f9519f7d6aa4658515e0d34
MD5 8183bc4093b5e2803d8b58c06108b68a
SHA1 3613fc42b4a849a4b972afd498b227eea07c034b
SHA512 6e2c0b0e0cc98f03853f9e37ef65033a5b996d860a231d3ec9e5be68027b9282053c73b6c44837a4d210655527d69bf07818055ffb09859634f5d50940d74a67
SSDEEP 768:AIc0s8Ww2YfWRm/JQy18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3BOLl/TB0OxQrodD:AIc0s8Ww2YfWRm/JQy1u1jaKBOLpTuOn
TLSH
T126E20A3B284CCB7E4F840E9DEC26AF966ED802CB66584D5447FE494C03C77EA521A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d9443d2abafe9469479e91431d54d50ea132c3583200857031efe9a237f3f34e
MD5 e3c438e9028c772bc4431416fa7523d1
SHA1 762756e52731fc246bfc0db713880dd47c6fe3d6
SHA512 de7be8b3d413445e6c42ecdb3eb0a370be37def31abb979245ff391a16623f1a1c6c5500959bed7af1f837d7ff0704c4c09af9f84751211709cd4c7707cde938
SSDEEP 96:KPz0NBDx1nI9++upnKGmuHnqrz2NlsmJCKCsZowK16aF:Uz0NBDx1I9+Rp7muHqrz2NlspdvF
TLSH
T1F591355171B626113D3D2409A3A0AB3B0B42B563305EA47B3BA8A0F19E67E710DFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 150B
SHA256 710e7970305bf827074cbcbe2759eeb815d0c30f3d01c28dd0324b6a4c64e6ac
MD5 bfe0bbbdb52e7b1c91006ab631b66d7b
SHA1 56dcfd2bbf44acefc4b678363c9aa017e6da5a85
SHA512 cbd26f567a6620be75c45e91015cfb7898cfe1265abfe9f56b26ee1f72594820c87936593f7921fd9d1ed3e9964a91d4fbce3d6e5aba4331d9dfcaba022ece83
TLSH
T11CC08CEB5990848F0B30D9D8106C721EC207884C88C0DCA88988800634345220012D39
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59012f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe59012f.TMP
Size 157B
SHA256 5beaebf9d55cdda1baa1892825a8d34ee2c776e4a4c0a65d2962c80ca9edea9f
MD5 3ad50f662f4b8af87189a11af3c04936
SHA1 6b5b154ace0404e1862618e6176ae5fc9fc01faf
SHA512 0f679bd7d820cd2ee5bf492c4291bc25fd2f06dae5d2e921e6b3a2474a4ca984d01afd06107b929568ee11fc7047df6317448795cc79ec1f009280982287d59d
TLSH
T1ABC08CEB59A0068B0B3098D8103C720EC2178C1C8CC0CCAC8988B00630346238022E39
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5910cf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5910cf.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 98d83806b7b504647bdff8181261b238cc67fc6b439cc51603f6bec82344c195
MD5 2d930df49824f5ecd62718061055beaa
SHA1 124a88267cb53c1f4f322e4fa83656c1a745a41d
SHA512 4f951290c1946f051dc22eac89b6210c379222cd308cd9ca831f943cad41b7c84e31f25919bde0e0fc18579680df0ed88262ac58738c7f44abf3d09456e88473
SSDEEP 384:ttNn/s3n9S+8NvDCf1k7Uu8YZusVuMo/mn15wbAjEnNx9Z:tj+95tG4CZ1V9o/mn12bfnNvZ
TLSH
T1BE927C325C3CAC27ADA3558CF54A361B1FB49437DAC83E48D5EC5F0C01EA6D86306D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 99db55b9ee48cc42fb32eb2ed473b596208ffd6bf6e4fba3150509e836259476
MD5 5f54a77a2c00e016c88daba0524301e7
SHA1 479473c6f8ff619c3e426344f018dfbd7153ae03
SHA512 1340e7d8ff27f2a4b1f4b5ba77d04c4951b3cb716228badb168c5f38bdceacc4ff204bfe777cccecff603c01705a51ce308b69d46d6e8069f45660bde98f1054
SSDEEP 384:IiF1tNn/s3n9Sm8NR8TUNTUlIlwCf1X7Uu8YZusVuMsq/mn15wbAjEnNx9Z:TF1j+9zEwgRh4CZ1V9sq/mn12bfnNvZ
TLSH
T192C208F248DB9436EDAE5B4BB73D2D074EBCC067B9842A54B3984A0CCC961BFD206D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0298ea2ab5d3b8f8c1a870c8e70cc843d1ab333628ce0d7ed9941ef1d8fc4a3a
MD5 9995409df2a43508c0ef18ad5c89a6bf
SHA1 e213dfe1732ceb221f3f89adf9f0b994ae50cfe8
SHA512 cc4fefcfb0165a48133e37dd3d049e3022aae362475c3724692ddc45eeb0e4d0ff74c40facefb1f5e3c6fe44da747df3d849bb4ead12b21caaa57256e1014e00
SSDEEP 192:XGNy6jCQmiUyVIgf4SufoPxzYuSus6cImcSneHxU6:XGNy6qSzfju8YZus/QxU6
TLSH
T10002DA756C7C786B9EB36E45F98737135FA4212BEA852F44CAE81F1C00D765C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5754cc167be1214f64d965657bda1bd29215d3ddc0c6ab906d80688c75707368
MD5 b8e7e185e7a17d1a6ed60d5192f2f929
SHA1 1404035c0010545d789bbb8c5fa4d26a2db44575
SHA512 09d333fe59fe76fecf5304c4e2ad8b6ae02e6ec5cc1a0fa7c8160a73252811f5772d8a314e40fbbd1c9790aec6734d8b9e4bdd49b124f431a629571733a1ee8c
SSDEEP 384:ztNn/s3n9S+8NvwCf1k7Uu8YZusVuMo/mn15wbAjEnNx9Z:zj+958G4CZ1V9o/mn12bfnNvZ
TLSH
T1C3927C325D3CAC27ADA3958CF64A361B1FB49437DAC82E48D5EC5F0D01EA6D86306D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1e50b54c62c1dcf7aa5ce75a0399d3c444fafe9b74a85fc81a5f737a0ad40259
MD5 ba1ed1815c27c412c0a40ff4f7730ef2
SHA1 23186f898e13b9a36e9fc2f4bc600c7488c87a75
SHA512 4ce24b10a13a22d5df3184297d7692476dcbde280815cfbb2a9b30fa0eb999f5177990e203bd4e228e56a347e2cd8c09c9d527cbcbf407d7809ac81ffdba9199
SSDEEP 192:jGNi6jaQmiUyxgZ4SufoPxzYuSus6cImISuMROMcqxU6:jGNi6KvZju8YZusVuMF/U6
TLSH
T1E11209729C6CB82BAD936598F54732135FB55127EE893F44D6EC2E0C01EF59C6306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f079ff02-1bad-4156-b43c-830444a42c7f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f079ff02-1bad-4156-b43c-830444a42c7f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download