hxxp://fotosgraciosas[.]otrosproyectosundfe[.]com/jajajaja/

Resubmissions

28/06/2026, 01:41

260628-b339haey214

28/06/2026, 01:35

260628-bzv4qaey3n6

Analysis

user interaction
yes
max time kernel
1200s
max time network
1118s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
28/06/2026, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://fotosgraciosas.otrosproyectosundfe.com/jajajaja/
Sample260628-b339haey21

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5376	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270844816363952"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-101591186-421676486-4137282292-1000\{76338D3A-DF4D-4B17-8D7F-2D1F6893002E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1516	msedge.exe
1516	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 896	4492	msedge.exe	82
PID 4492 wrote to memory of 5376	4492	msedge.exe	83
PID 4492 wrote to memory of 4780	4492	msedge.exe	84
PID 4492 wrote to memory of 4780	4492	msedge.exe	84
PID 4492 wrote to memory of 4780	4492	msedge.exe	84
PID 4492 wrote to memory of 4844	4492	msedge.exe	86
PID 4492 wrote to memory of 4844	4492	msedge.exe	86
PID 4492 wrote to memory of 3080	4492	msedge.exe	87
PID 4492 wrote to memory of 5956	4492	msedge.exe	88
PID 4492 wrote to memory of 3080	4492	msedge.exe	87
PID 4492 wrote to memory of 3080	4492	msedge.exe	87
PID 4492 wrote to memory of 5956	4492	msedge.exe	88
PID 4492 wrote to memory of 5956	4492	msedge.exe	88
PID 4492 wrote to memory of 728	4492	msedge.exe	91
PID 4492 wrote to memory of 728	4492	msedge.exe	91
PID 4492 wrote to memory of 728	4492	msedge.exe	91
PID 4492 wrote to memory of 2316	4492	msedge.exe	97
PID 4492 wrote to memory of 2316	4492	msedge.exe	97
PID 4492 wrote to memory of 4232	4492	msedge.exe	98
PID 4492 wrote to memory of 4232	4492	msedge.exe	98
PID 4492 wrote to memory of 5900	4492	msedge.exe	100
PID 4492 wrote to memory of 1112	4492	msedge.exe	105
PID 4492 wrote to memory of 1112	4492	msedge.exe	105
PID 4492 wrote to memory of 3648	4492	msedge.exe	106
PID 4492 wrote to memory of 3808	4492	msedge.exe	107
PID 4492 wrote to memory of 4332	4492	msedge.exe	108
PID 4492 wrote to memory of 5596	4492	msedge.exe	110
PID 4492 wrote to memory of 5596	4492	msedge.exe	110
PID 4492 wrote to memory of 4772	4492	msedge.exe	111
PID 4492 wrote to memory of 4772	4492	msedge.exe	111
PID 4492 wrote to memory of 5456	4492	msedge.exe	112
PID 4492 wrote to memory of 5456	4492	msedge.exe	112
PID 4492 wrote to memory of 5456	4492	msedge.exe	112
PID 4492 wrote to memory of 1516	4492	msedge.exe	113
PID 4492 wrote to memory of 1532	4492	msedge.exe	114
PID 4492 wrote to memory of 1532	4492	msedge.exe	114
PID 4492 wrote to memory of 1468	4492	msedge.exe	115
PID 4492 wrote to memory of 1468	4492	msedge.exe	115
PID 4492 wrote to memory of 1788	4492	msedge.exe	116
PID 4492 wrote to memory of 1788	4492	msedge.exe	116
PID 4492 wrote to memory of 4700	4492	msedge.exe	117
PID 4492 wrote to memory of 4700	4492	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://fotosgraciosas.otrosproyectosundfe.com/jajajaja/
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7fffb262c188,0x7fffb262c194,0x7fffb262c1a0
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,6087360410305490732,15140368550183167734,524288 --field-trial-handle=2276,i,12238085752730619867,16244555845852401595,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,6045535717765924625,8901342819780635309,262144 --field-trial-handle=2276,i,12238085752730619867,16244555845852401595,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,9005108705380596820,10974333055979578106,524288 --field-trial-handle=2276,i,12238085752730619867,16244555845852401595,262144 --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,12561901560434656050,3127909721177075316,2097152 --field-trial-handle=2276,i,12238085752730619867,16244555845852401595,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,4214253506241977054,729967592454705861,2097152 --field-trial-handle=2276,i,12238085752730619867,16244555845852401595,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4900,i,14861730676068923207,15969155585284368648,2097152 --field-trial-handle=2276,i,12238085752730619867,16244555845852401595,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,14048842860098048492,4707901161695843808,524288 --field-trial-handle=2276,i,12238085752730619867,16244555845852401595,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,169403281979918839,11157671451601440285,524288 --field-trial-handle=2276,i,12238085752730619867,16244555845852401595,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,14836227952127289139,9965325803439013201,524288 --field-trial-handle=2276,i,12238085752730619867,16244555845852401595,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,14836227952127289139,9965325803439013201,524288 --field-trial-handle=2276,i,12238085752730619867,16244555845852401595,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,4017829929867530546,15434272001652847554,524288 --field-trial-handle=2276,i,12238085752730619867,16244555845852401595,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=716,i,11750286687472869490,2715520777851122481,524288 --field-trial-handle=2276,i,12238085752730619867,16244555845852401595,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,16832565605167875279,14523445795939851831,524288 --field-trial-handle=2276,i,12238085752730619867,16244555845852401595,262144 --variations-seed-version --mojo-platform-channel-handle=704 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=132,i,16127733713034621089,4809632803888487531,524288 --field-trial-handle=2276,i,12238085752730619867,16244555845852401595,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,15858529330399731582,5291385089375314433,524288 --field-trial-handle=2276,i,12238085752730619867,16244555845852401595,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,465529380336411506,81895372555333346,524288 --field-trial-handle=2276,i,12238085752730619867,16244555845852401595,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5368,i,17696003682960595142,16615671442408385324,2097152 --field-trial-handle=2276,i,12238085752730619867,16244555845852401595,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6652,i,4680730998657384969,11296375844179663112,262144 --field-trial-handle=2276,i,12238085752730619867,16244555845852401595,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,131235933158640418,7344619383759654699,524288 --field-trial-handle=2276,i,12238085752730619867,16244555845852401595,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:8
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3968,i,7447813526300504091,6210017555848729501,524288 --field-trial-handle=2276,i,12238085752730619867,16244555845852401595,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,10896590159819833050,12581366688957080636,524288 --field-trial-handle=2276,i,12238085752730619867,16244555845852401595,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,16837434261977444713,9805241061417329773,524288 --field-trial-handle=2276,i,12238085752730619867,16244555845852401595,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:4700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35cc5409a0e92c7b1f173401d1114c9d5fdc977752a8e45ce9068d8101c9a651
MD5 4177a98ec95c7b8511089a1be66e9e7b
SHA1 523d632928047252508b7d45169327ef4523179e
SHA512 d9e67625f1cfcaf9b90149a3ed0ce8899f43e93e14c729f7cf114adedf8a6a345c93240cebfa58351038924578a437d9d7144c7dcd826b1b8892dc523920e947
TLSH
T17AD08077670FF411E36D5131D503C75117AE547179625723F118C40D99741D693C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e9b606cfbfc7b0fcbfab1ff9a90d94ddcf0c4033903cc47f13cbcd8bcac95cc
MD5 66bd1dbef8b4df50e7a09a2d2848fb79
SHA1 69983a576369225e69f3c4e38eef011e7e436249
SHA512 7f8546014287d3ced2b59766b273c8d8981aee3ef643630332615e594a89f92a95f1ce112c2fa889b0e249a10643792bfc57043bfc523d6ada97b8bc7d6e7d6c
TLSH
T17CD080776B0BF411E35D5131D503C75127BE507179625723F158C41D99B41D697C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 6285e260f00df4d6ea5f0967f0dd20c606a555f7d5361485afaced9f45578a09
MD5 9ac52a3ff8d757dda12bb505bc374893
SHA1 c7b5fd1af1e8d95523ba2a902cbdbe61959d0450
SHA512 8abee74791cde6383d41acbdd1fe7239771426cc1d7ef1127431280afdcb822fe98b7d20c2a8e79b0e60567bfa221ec60d690cf3c4576ad782316ec5a17d0309
TLSH
T195E0D84493C4D6544523B9CB8655A71C8C10710EA74A98DD7229ED4C24427006A99B91
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 9b28e94dcc3b78b5842b8c0bbb139ea6dcfbd767befeffc8dbd548c8369909e6
MD5 acd51dd9b8279bb7deb856f18a720bb5
SHA1 c418045299787d2175918f38e57f44e380528baa
SHA512 8211cf582ac5cf0525a98ef1ad29efda9b6ad966662c551f2ecb6b0afb701f33e83f86d30ca357ef6fecb373b5299a589510098c9f64e1eda159269d376a21e2
TLSH
T109E02685D6C8C39E96D1B4875278930CE2C2360F9AC8A94E170889883081B80A2C6A91
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 268B
SHA256 ae99fdfc3fbac7deff206af98556f3993f1c3f40fe1176939f3effc93833bc8d
MD5 9683ee0effa2bfca240118d3a9a92e68
SHA1 7f5846f3cd2adc8fd0788f67733e1a66a9a4502d
SHA512 063dd8a1a4838b395fcd50939ca3e5b24ac72a8407ffd4463838b0b2ee5bb8d41938609e4216ead91f6f1a45a694113987c815ba88fb7d83f6eb6cc2fa33d737
TLSH
T194D02B9AFDEC9E5ED7E41ABD5BA5B4000A4802A2840B9B1300747EC03495AF01E25030
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 85614c88bdfcd5ec6c0548e8fb36dce4f0e25b6071323f21a957ff5a4ce9d4d9
MD5 8e654655f0b6e2dcf869cdcf9130b0ba
SHA1 410b8f9e06a733a6a58f9326ffd08a0a8dcda4f7
SHA512 638e71a62bae6b1ce97d259d56a43ede4bf698bac01d70a61b24911cd6d3568043468e1db2f1abcd3055e10b68dcca82f3ad1a985fc5e8e81fabdff07b997455
TLSH
T1B5E0E5EACA229C2704FC5B1C74190746D60003562B41965B3A3D5108CFB2A7B1996C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000b8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b8
Size 834KB
SHA256 59d043025dd9f383a21228440daa5224c3d578b404e0b29d05cc2ef09159903a
MD5 c48075184c075dc2fbc1c45f1ac41692
SHA1 21be9f8bc2dc5d5e48ea84ae9e49228302f1e955
SHA512 c5685b8132a26aee30256c80ca64ca258b50a73758eba4aefdad7aa352d3a0edec563311c1aa883642fc51ddc91011b54aad0144bcfef44d2cf0fd930fb842f1
SSDEEP 1536:tvkKrsJ7VTd4OvRNmH6mYgge7IWkjD6dhtoSDAM89Z3AAwlU70:t8L34OZNmahDW4D6dGj8
TLSH
T1FD054ADE179C531DC27B647464E09370737ADE988A584B078A873A951EBF1C42E8CAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000100

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000100
Size 1024KB
SHA256 a16488084d00b6dc00877fcf2a70168aa2385adf29c365c92d9920267dec9310
MD5 0f783c459c048086f874438580c8fe7d
SHA1 a158e608e8e5375f523b70e61e007f48156323f6
SHA512 d7e09c2f36e47924fffe602af2097619f8fb97be83ec40d3045d8491a4317fff0a60dd3db9d2610018eafc957639ae6701f406e609ff2aba687c3b3ca30266ed
SSDEEP 12288:EIst/Davcpwdhrmf+HPMgfwczgR2+34+QxhZnL+2skyXri3mtyQ9pg4Lh3uEHxI:Rs6BRW+xf1y2r+Q5nskGimFzFuEHW
TLSH
T16A25F1F236F1CE2BFC0A3371447A9B568B4EE7A0651C2B96780A774014E75C29B71EB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000101

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000101
Size 94KB
SHA256 fb5192948980adf0b182f13f4a5afeddef1572969fb12022887b0654c7a35f5f
MD5 950c43b4370ebb7d46e205c2b8207f35
SHA1 c4c85da9ae1ca47889ea64e5cfda8f6e866e9454
SHA512 b0efd8a67efcb2c36ded9442e961da4d345e0e05974a6e95d45351472ea45ed39730d3c253ecb459a4b657cca212132dd2b82ff8b50ca005a11db23ddbd61db9
SSDEEP 1536:CebYPYw91Tws14XMPa//n680w5TBWgZdaDBQuSzBNy60OTV59qqp5SiFg9FfX6bo:zbanv1CMy/SGxlZdqBQx9NycJWqHSiFo
TLSH
T1FB93023B7A5787E2FCAA15F38A024C0596C6FA49757D7500E94FA099128233BCE02FE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1fefbbff01111dd2dcf11dcec2cd4bb16ca5d2ed28c63f8d1fbffe34c868751e
MD5 1562111a5cbe8d25cc32b2dfdf1ce1cb
SHA1 3d8a5f3adf2b82bbf8f5ad99dd791ac847e4e06c
SHA512 ae0791b524601966ff6c794b211ddd443f7eba51ae030c634af35194402494a5196b299dd1a455b90ed52160c5282dc7757451a59874322d20b512922c155a3f
TLSH
T1C181BDF753B1C67DE9105AF4E7087E1B8E280424432C79A98DE0AE27D7D62B1D14275B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 19f10de97fa076c8bb40f43dae3fef02fde9b8263a7f2423899a1070b9ca9d22
MD5 81a42dbfff7ef61e08122db15fe7e99c
SHA1 3e7c788a06a9a6fd9502a9e8ec893cb1677ca085
SHA512 d9fb3a7258c8d0255bae988000b28a86b26122b3284b5b47a77293de47c5b7b494c022fa0f3986c1740bb8dfad996d29282d2d90ce15519d251a828aa785fa59
TLSH
T11D81BDF753B1C67DE9105AF4E7087E1B8E280424432C79A98DE0AE27D7D62B1D14275B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 253be4a4cf3f2bc04eca3695e2ae9b14e6dc21ceeda37467cf4d8f41be4db6f6
MD5 89195e1d397a628365b77099359a93c4
SHA1 967c98424c8238d31b9a1a5e308524e9e84bc96d
SHA512 184244b45672140b855d02ae9e5de4d4a4db4bed9dcae58b4e5531c629973804319f4627c2b4263e8b607e89546c6def383834fab1082f5dbafd2c7bb508d878
TLSH
T10231C0F383E4856E8A0195F0AA18AE2BCE1D0514432C3D9A85E4AF1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 4e0bb086d03fec13f154b3c53a903666c4600dc79079cd9b98737a0f7418631b
MD5 3272bb87227b0c34c91f8ec892250f6f
SHA1 aa8bf0c7dd00e3f35ff7583c73de6e4e26bd77e4
SHA512 73ac2231dccb31ff53d604efe343ec87d1a79a975a77477b655055ab14f77395444af7a72a7b932b61d179885be64dde64c56e71f8acfcd785794ff4d31232a1
SSDEEP 96:D1jOi0i9iODiSaaij6UzFigizi1jQw91iKiDiSicUi9:D16i0i9iODiSaaij6UJigizipQs1iKiV
TLSH
T1A091BBF293F5862DD91156F4E7183E1ACE2C0824432C3D9A8DE4AF1B97D6271D10275E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1d7698981e59c12fd775b80bec5d874faf4f7e71094ecd1d735ad18963c9e0ac
MD5 15401fcf5b96f0e861288e0cbc6c2ace
SHA1 4ac717078a131f756537661b77465a9c6ddb0146
SHA512 df364f6ee2bee7f8590d10438244ce06efb6917bf243b4b335b22cf402a5de5296a6219e240672c0a02a70207249925abb474b1960f01d5804cfa79e57159ddf
SSDEEP 192:sxZXKRwyMqZjK1Ml8MkK/fwshfuo46ggzodpz1HW6+WNb+t/YX5rg2QIglRxJ:sxZXKRMK/fwshGPBHbI/QuX7
TLSH
T19362EA166A389D7BCCD7D209F945BF53D7F9456392905E44AAFC8A0C04E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f5e712fd1d813aa54aee2cb72d19dd92b4732f209a67882b58387d6df764b647
MD5 b8af7479e2d9f1c5173b27b9a38f6c35
SHA1 51096b37e7e41fd41884c965a0481cedbb8a3714
SHA512 154b3923dd6bb32c54805ef29da040e7cd27f96633fcca74b64e30684441cc145e51e5175f9735cca372f6a439d807524844cafb43920c0d9d8436f45ac9adda
SSDEEP 192:sxZXKRwyMqZjK1Ml8UQU9K/fwsOFVuo47ggzodpzZHW6+WNbIWNYX7ZgwQIg5mR7:sxZXKRqSK/fwsiMIlHbhNW0w7
TLSH
T14672F9166A389977CCDBD20DF9457B93D6F90523A2905E44AAFC8B0C05E7ADC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 33a391965bb825fae1d2497f21874e02decd5b8ff9cdf8aebc5e72f48bfeb07a
MD5 f507ff5bd5c06654fcd9e4a6ca28d6b2
SHA1 a6187c5652047c7037e91a584b1ca96d7dade399
SHA512 3e724b626826c7c781641fa2a424bc9a18388d5a8173091a2139547486c15caa5137487bd38922f981006881decfd8ac7a5b0db4c5c85de6a406a6263478b5dd
SSDEEP 768:/Zk4PXDWvXt4h8F1+UoAYDCx9Tuqh0VfUC9xbog/OViiLl42vJ4roWpN1Z4STU:/Zk4PXDWvXt4hu1jaHiL+QJDWpah
TLSH
T1D0D21B3F680CCB7E4F844E5CEC26AF966ED801CB66988D4447FA494C03C77EB521A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\99755d9e-864c-41e7-ab4d-7cb31e17682c\index-dir\the-real-index
Size 2KB
SHA256 e4690d2aa54489d28ec49124c6829aeffaab17cbd4968ce151cae372daac2159
MD5 17e136ea80e585dddd74f5723a8e72fb
SHA1 5ac95a8b8c095071f29b5dc1b3fcc0b5d86851a9
SHA512 552de95cb2749e851c8b7af0f8c126b18a658497f8c3191cd60e1ea3cd4f96fe3e8a7e14532362b83f46f34116624b68484c76bdebc52ce4ad15c1cd0476cda5
TLSH
T1CA51848E4D15965AE9F846B310B360903BF098CC2B1196135CED2236E88776E2D1B7A9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cb0e9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\99755d9e-864c-41e7-ab4d-7cb31e17682c\index-dir\the-real-index~RFe5cb0e9.TMP
Size 2KB
SHA256 5c33ae98e0864a842d3361cbab24a77f65cde56ceef68842b977cd5c1b0fc08d
MD5 a86337f483448d6dfff37efbf6fe7174
SHA1 4395bf4e6ba9c5b8a6f62da390fcebcf688f383f
SHA512 ef6d3e573670ede5eef1167521997377323576aca6705782b4e01511b5b85de795d92175956f53554b8483ae92d334ea9a2134fa54fa271e7a087c8c1d164226
TLSH
T1CB51858E8E42863ADDD445B309D3A4A43739A90096157F4374FC9636ACD23AD7E1F2C5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 78bbcbf229152b35923945f06bcd2218948be0451d01c5d263b459e9c2118913
MD5 bc27a846d1ae71f509a05e74188fd11b
SHA1 5828581a9c952693a97a2acb85490e3f90424f08
SHA512 08db5b1572d6e1b56c90fa98b91308fe2df4a47bff0fca0eda76a5b857c94d522aa90fcebec0058b8ff20bfa8d230d0cca8175918d04627c32aa3d8311ccfa7d
TLSH
T150E0C0FB2CD31D00ED7FC3C1347224514A1135988904AC4F102E92C3B0A16142813C73
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8dc766359fed5bc8528c7fd8c7d0ce2f8540ca2893d791eda19c923961ecea8b
MD5 f22ad3f5516fb0983c86a6d43c3796a8
SHA1 8965c2a7e6c45ac405aafc509239baaf2c4fb0f2
SHA512 98d2768bae9769ee5d04838a1c22b09cf87e6ea4d2a3f8e2541cb11f3f8bf0a4b1d59f47e477a39cb0fdaa141aab057368ef735ab7a1b802fb19d69e7744cd89
SSDEEP 192:EtjGz7Y1/St59NZp1ZVzDqHgnmz3th9AZkzPr1PVIfPU1eNJd:EJGnYNSv9PpHV/qjQ3d
TLSH
T18BB22C13313A03423CBE2518A2A69A779E4231B3301DE66F77A904B54E6BE125DFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6935ceea89bcd8e78c954fafb0cf1fd231b3a3dd4f039e5a39edf8693c4d08d1
MD5 1347ee327de70c1af74ae832743113e7
SHA1 11ccba4a3ee45d0562e019bb9f9c81b21193067e
SHA512 4267a141ae55e32bfc8b5a55c42ac8bd86adce6ec5eeb1eb6f0f725bea81f43ade8167f2e2b59259872b80e77c4710a237bfa2b04b38c8688a3c4ceaf4780bf9
SSDEEP 384:nsniF1tNn/s3n9SJ3sNJ8TUNTUlI4kfzoNmUQ2weflV63CrsvQcQdomn15wbAjER:siF1j+9o3+wgf1cVhwQcPmn12bfZv
TLSH
T168D24B32D864CE77ADE78EC9B74A3A07EEE0426386CC5AD4D6D85E4D01DB29C130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 d6236ff4e09b08350e047e28caf63384f94bbdc6e0b5d9bdd9e760edff40c88a
MD5 a8b64bcaeac824d47feb2ff3ab2519ce
SHA1 f6ffecf357e1bc77d9944306b32fb615395f9da0
SHA512 55eceb41a5b8cfa8cffac50182604eeeb4ba5f85ef2571f364d424d582b72ed5ffda33f4b8fa867c142b4487ad2cfb431edb305d1c4470123e019561714bca10
SSDEEP 384:nsniF9CcmyWCh3sNJ8TUNTUlI4kfzoNm+Z2weflV63CrsvQLQdo1Hy/7IgL:siFccph3+wgfOcVhwQLPS
TLSH
T14CB23A32DCA4CE77ADE64AC9B7563A03DEE0426386CC9ED4DADC1E1D019B19D034BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 f9bc5c6507dec21afddc5f701e48b27ffac7ce8cb7181b037f0e717a09b2b95d
MD5 b460c116125a69df1c3f6178e21c9990
SHA1 1ed4e6e527d18c25c127c4a802a69aab228989c6
SHA512 00c3356e1cd77963ce59fcb94b11946e5b7ccec74ae76b68f1ba718c94425db7e7e2c875d1d823ae6beb7f59507274d3a1b132a8134ce2eddebc46fad33456b6
SSDEEP 384:nmDiF9CcmyWCs3sNJ8TUNTUlImkrzoNmfMvweflV635Q1QHUahkP+lFYS/4RHy/B:muFccps36wglOdVEQ1yhkoFYS/4g
TLSH
T1FBB25B36DCA8CEBBEDF64FC9EB4A7A47EEE00163858859D4DAD81D0D008719D1347D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 50396f95a5ce21b625d19006d862316952692f652b0c08932ca5d366ba430f37
MD5 7a57ed3aeb8e63021eb879813aafc439
SHA1 1e7767c195c449217d504291dbb7dc61725255ba
SHA512 85558f40a813a2ab42838074e23471c631157459041928aa856fd42ac9bf9a1e5f1c4f36e678b6c131ee2b9797274358fd352233abb8ddda0de5813de6182973
SSDEEP 384:nUiF9CcmyWCs3sNN8TUNTUlImkrzoNmvw3weflV63CrsvQ6QdohkP+lFYS/4RHyZ:vFccps3OwgleVVhwQ6PhkoFYS/4g
TLSH
T169C25B32DC94CE7BEDE64AC5EB4A7A07DEE04263868C9AD0DADC1D1D01DB1AC034BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 307f0d1e942965a9c24bf82877f3ec6b81cf2ed67202ec56fb9cbd2665b84097
MD5 6b4a0e72bacec67f881ac04de8ea03fa
SHA1 53694bab80d833a0cda18e18ecbcb624a2296ccd
SHA512 32becd73a8b0f73e134d8fd7e4f4e384043d28d7db6816ab9f3b96859b8887eac7c0432cf24f03b7ec2b1dc678375a783fe65f03348a61daeeb75ac2036af919
SSDEEP 384:nKniF1tNn/s3n9SJ3sNJ8TUNTUlI4kfzoNmUQ2weflV63CrsvQcQdomn15wbAjER:KiF1j+9o3+wgf1cVhwQcPmn12bfZv
TLSH
T176D24B32D864CE77ADE78EC9B74A3A07EEE0416386CC5AD4D6D85E4D01DB29C130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6da431ea1fd9048b1f328b36b53a11b03d6203c25c148ebe06b97268de926bc9
MD5 3d54f29e078c33e5fd57af068e3a724e
SHA1 2790897757570324d0dcfe856f9533e60c13b6dc
SHA512 d6a1aaad4ef5260c1c090126166caaa58f180a14992e02057cd9e4540400aed1f54456cac16b7f6b1e85500c24e44d3ff81385a01d032d51d393507e1d28fd36
SSDEEP 384:nKZiF1tNn/s3n9SpF3sNJ8TUNTUlI4kfzoNmUQ2weflV63CrsWQdomn15wbAjEOy:KwF1j+923+wgf1cVh5Pmn12bfZv
TLSH
T1F1D24A32D864CE77ADE78EC9B74A3A07EEE0416386C85AD4DAD85E4D01DB2DC030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e8ed1cedbe969999c03284cf7bab59d103df5f4e19ea8ad5a9b9df44910c5440
MD5 f5514280954dca4d16f354984813cb85
SHA1 8838a9e3580eb449ea617e401b08824d3bcf33c1
SHA512 491448eed86d1966ce825fd9ab7685170d1817fd60c35ccfa69fa92b5a65925d0c0947963d10fdb12bb08e040016155423ca29734344414ec50092c6c50601b8
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bc814dc8697adf2df2fa282f1605f3bf72ce60a9ace49e5e0a28d5db0879c3ea
MD5 8db4cd63f8d1436b8764ddfd19dd66ad
SHA1 fbfff0cbc0157e8fe76717b7705d41f1fadd527e
SHA512 b41601e5fddffa8563473c9ad04f0c49c8195d0c67dbe39e1df2277a4bbb3771ac0f75bd4cb27e76f54dab20480b887eed573b312eb893d17954a371685b786d
TLSH
T1C6E00207D3000082C054033101835F042FE2C1615A26070F4B3002AC3C373457C08610
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59ea66.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59ea66.TMP
Size 392B
SHA256 e13bc9f2de94d74d5dd02060044bfbde8a526fab7ec9ccf5745ba4a3f9873665
MD5 04960446250be630b89e3703d510da05
SHA1 2bb3e1c2137cd2cd15bca9b1e42f4184b784fefc
SHA512 07a8aafe650e0293b0382e0de43fef417c844ffb47d2060ad5a93e21e43e4add59af74aa8a669b0e23b8af0884a2e98dc07c96c577f32b6e8356aa1743de37ce
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ed6de0a902ac4f42167205b20537048075ae4417b3f7a891a1a94512693f7190
MD5 7e98f090e82ffa711b138ea926ba454e
SHA1 39f146e13bbafab4809e864eabfb64369be05832
SHA512 65633bbd88ae79ba7e145292cc3105f4f8bcdf98921abba9be4e9e19386a888ab2b8147f26888ff49d155f01acf9a0310bb6b2eb5b50b127e21778f1d0d83a19
TLSH
T153414A98B6E91148B3B72E5AAFF7686D487EBC372F0AD45E10010E4F4A22B40C971733
MD5 SHA1 SHA512 TLSH

Submit Download