hxxps://wordash[.]me/backend/track_online[.]php?sid=y0gd805pe5h1782840855229&source=livemexico&title=PuroGames+-+Tu+gu%C3%ADa+de+deportes&lang=es-MX&acc=

Analysis

user interaction
yes
max time kernel
449s
max time network
440s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-es
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-eslocale:es-esos:windows10-ltsc_2021-x64systemwindows
submitted
30/06/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://wordash.me/backend/track_online.php?sid=y0gd805pe5h1782840855229&source=livemexico&title=PuroGames+-+Tu+gu%C3%ADa+de+deportes&lang=es-MX&acc=
Sample260630-w15d1adv4m

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273174745217476"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1108628292-2849104889-3743975892-1000\{CD597DBA-1FFD-42BE-B2A7-2ABAFB913809}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 3548	1144	msedge.exe	84
PID 1144 wrote to memory of 2000	1144	msedge.exe	85
PID 1144 wrote to memory of 1640	1144	msedge.exe	86
PID 1144 wrote to memory of 1640	1144	msedge.exe	86
PID 1144 wrote to memory of 1640	1144	msedge.exe	86
PID 1144 wrote to memory of 1700	1144	msedge.exe	87
PID 1144 wrote to memory of 1700	1144	msedge.exe	87
PID 1144 wrote to memory of 3040	1144	msedge.exe	89
PID 1144 wrote to memory of 1472	1144	msedge.exe	90
PID 1144 wrote to memory of 3040	1144	msedge.exe	89
PID 1144 wrote to memory of 3040	1144	msedge.exe	89
PID 1144 wrote to memory of 1472	1144	msedge.exe	90
PID 1144 wrote to memory of 1472	1144	msedge.exe	90
PID 1144 wrote to memory of 232	1144	msedge.exe	91
PID 1144 wrote to memory of 232	1144	msedge.exe	91
PID 1144 wrote to memory of 232	1144	msedge.exe	91
PID 1144 wrote to memory of 212	1144	msedge.exe	92
PID 1144 wrote to memory of 212	1144	msedge.exe	92
PID 1144 wrote to memory of 212	1144	msedge.exe	92
PID 1144 wrote to memory of 2792	1144	msedge.exe	96
PID 1144 wrote to memory of 2792	1144	msedge.exe	96
PID 1144 wrote to memory of 2756	1144	msedge.exe	97
PID 1144 wrote to memory of 2756	1144	msedge.exe	97
PID 1144 wrote to memory of 896	1144	msedge.exe	99
PID 1144 wrote to memory of 2640	1144	msedge.exe	102
PID 1144 wrote to memory of 2520	1144	msedge.exe	103
PID 1144 wrote to memory of 4044	1144	msedge.exe	104
PID 1144 wrote to memory of 4316	1144	msedge.exe	111
PID 1144 wrote to memory of 4316	1144	msedge.exe	111
PID 1144 wrote to memory of 2176	1144	msedge.exe	112
PID 1144 wrote to memory of 3116	1144	msedge.exe	114
PID 1144 wrote to memory of 3116	1144	msedge.exe	114
PID 1144 wrote to memory of 568	1144	msedge.exe	115
PID 1144 wrote to memory of 568	1144	msedge.exe	115
PID 1144 wrote to memory of 2172	1144	msedge.exe	116
PID 1144 wrote to memory of 2172	1144	msedge.exe	116
PID 1144 wrote to memory of 3944	1144	msedge.exe	117
PID 1144 wrote to memory of 3944	1144	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://wordash.me/backend/track_online.php?sid=y0gd805pe5h1782840855229&source=livemexico&title=PuroGames+-+Tu+gu%C3%ADa+de+deportes&lang=es-MX&acc=
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2a8,0x7ff80454c188,0x7ff80454c194,0x7ff80454c1a0
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,4145691506146861808,11793773851012839892,524288 --field-trial-handle=2300,i,14441020941763678928,2898038740101190785,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,12969562942828088870,17910690534472974853,262144 --field-trial-handle=2300,i,14441020941763678928,2898038740101190785,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,14227882453262896605,9529446652897349388,524288 --field-trial-handle=2300,i,14441020941763678928,2898038740101190785,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3240,i,9160438352934907669,3852933965129447945,2097152 --field-trial-handle=2300,i,14441020941763678928,2898038740101190785,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,4881067194404951921,314263772442621905,2097152 --field-trial-handle=2300,i,14441020941763678928,2898038740101190785,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,5472149404336835271,3215113223621670299,2097152 --field-trial-handle=2300,i,14441020941763678928,2898038740101190785,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,7842271286323063439,15853641264283596727,2097152 --field-trial-handle=2300,i,14441020941763678928,2898038740101190785,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,14705783441602807191,5227832311230203186,524288 --field-trial-handle=2300,i,14441020941763678928,2898038740101190785,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,14872298765857370166,8565225646830291102,524288 --field-trial-handle=2300,i,14441020941763678928,2898038740101190785,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,8328728411738225021,10586585602982365496,524288 --field-trial-handle=2300,i,14441020941763678928,2898038740101190785,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,8328728411738225021,10586585602982365496,524288 --field-trial-handle=2300,i,14441020941763678928,2898038740101190785,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,15509793439090940486,2883526275188919200,524288 --field-trial-handle=2300,i,14441020941763678928,2898038740101190785,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,8682431711219623967,16047309516622091155,524288 --field-trial-handle=2300,i,14441020941763678928,2898038740101190785,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,4535644473737914301,13410338743110275885,524288 --field-trial-handle=2300,i,14441020941763678928,2898038740101190785,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,3850150024550549091,232898488170725071,524288 --field-trial-handle=2300,i,14441020941763678928,2898038740101190785,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4452,i,13167463558545985771,10006034930984580955,262144 --field-trial-handle=2300,i,14441020941763678928,2898038740101190785,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2088,i,7718735412884936233,16042411918726155249,524288 --field-trial-handle=2300,i,14441020941763678928,2898038740101190785,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,13389208982367640268,7189448447994860090,524288 --field-trial-handle=2300,i,14441020941763678928,2898038740101190785,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,1009266927608989806,11378711727325786405,524288 --field-trial-handle=2300,i,14441020941763678928,2898038740101190785,262144 --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,14443230938798025580,4833835972553655482,524288 --field-trial-handle=2300,i,14441020941763678928,2898038740101190785,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  PID:3944

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5ff05a621df8df05426fbba3639de62cbb6d573187a90f20bc797fdbe4b71bf
MD5 c23168c2b4dd096d77fb57bb53393a90
SHA1 0038662e136abcde2c29c9d3d3c3bf2dbb11d164
SHA512 7ee97c45aa94467885b8aa2145e0879de4ec2397c36198ceede5ec06664080ad500e1a9d62566de09c10902658158cd7d9f529ec85a76fea0c32eb7ae7182b5f
TLSH
T1E0D09B2036CD5443C59133B398455F45165D59681556D242A434514CDAA6044E36654A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67c3d537374abf4a4065bd49eb5e79e4d5afe358a5731186278c6aee60766d9d
MD5 4e493aa418041fca5fa30fcbfdf660dd
SHA1 ea939d51c02b7420c2eb0e8a20246e28cd7e7c4b
SHA512 25c896cd04f1a8a5daf896cad6530f5a015265fc30399b7facf3a6fc2016b03aaf4a88ce889166d73a86b0b17a17d7512d0edca0d80e9707d3e081708a5000ce
TLSH
T18CD09B20768D5043C59133B398455F45165D596815569141A434514CDAA5044E36654A
MD5 SHA1 SHA512 TLSH

Submit Download

1e2b10a0-f385-4769-858e-3eb3e7a63d45.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1e2b10a0-f385-4769-858e-3eb3e7a63d45.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 cddb7947ecae4215bb74b5b5a01da3b24e2a51179f5f508d2bd21ad159e4134e
MD5 970cc6088eb74c6cb9d551190fb8a786
SHA1 743f1372ceffd983c136dc1dbb4f0dcc5bbf5347
SHA512 122ea6647a214ef2af352528a51ad21b8f57d1dcc53743dca7b37786878d8c4cb055ded579a0afd7184b458447a5fe449a6808a046215e1913f05fb914b2066a
TLSH
T1A6E0D8D493E8F7AA9118B54F80A4F224C210714F95CE84DD2204F585EE0180642D06C6
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 62792d5f8145f4bb0cf2f7afea951b0f295b432a02334666f68d1dbd9e9f8b6e
MD5 a4463e9a5ebc4a2cfcbb70ce19cf0aad
SHA1 3812b62758c9d9edaf2645087d37345257bc5759
SHA512 ba535d37c8b447b486377f0104fc583ccbeecc502372cf048529fed63c03430ae081ad7e2964d1d078a8e057570f1e847c96b60f33db6b9c0aeda7f31ae6631b
TLSH
T1FD713A172E8247E1E392C1F3A7DA46433A3ECA3CD9675EFD63116474D50BB14D09D608
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5960d3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5960d3.TMP
Size 3KB
SHA256 29bf7e0ed8abe12801940f1115907723239bdf28d99f49337485ba4ace36d3b6
MD5 bcf704fec6003f3283d3eb7539296496
SHA1 5a2a84579d2847377172e46b23cacd96b765c121
SHA512 3f6c1abc51d80063b152909d6f0f64a36b534bb6bc6272a3182f80938fc9800a4afa598a1cbf0be40c41e7b0762b065e986b5314b479957aa1015b6577cdf8f6
TLSH
T14C712A172E8247E1E392C1F39BDA46433A3ECA7CD9665EFD63216474D50BB14D09D608
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 9be535ed568a139bb3c90f462fbef0d4a24f7fb433d850ace4ade58aa039e9fe
MD5 e7ce002f545c1479c095bede5395d736
SHA1 9b4bab34582419ffe485f5978251561e29e5a31b
SHA512 32970eca102e80ec13686c191925853583297d9a92c4ba912c5d8db06a0d4c1379bba90aad32d822f011b393de61f0c64f385ff348a200ec7c79eae0acb1ce60
SSDEEP 1536:TfEEjWlttjpGZqW3ynPDuVLpBO6CvBcZs862UqPq:gLlEt2BmNUH
TLSH
T180B36227D6A64C6B01F16264EC754383F325436F9286A82F3A3C5D5C2FBD93A6502F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7bae30bec9c45571ad473070852c314104cbd63424aec9c0b36cf3269e833b6e
MD5 66e9a6c74dcf8246badfb45b07993917
SHA1 52e15f62e527eb20c9b0e6f74f9b65f914021b7c
SHA512 b05de5546bb1649a1e852a9402b241928e2e0f73d51528afe42c381c6fe17e23da51bc729cbcdd77d27898fd5808a893cf2a1714db9a2f37f37989eb5587a62f
TLSH
T19C319AF783E4866DDD1152F0AA68BD2BCE1D0419431C3C6B8AE0AF4BD3F2421E145B4A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 dadb9a4fe4cae06e058b4ed499ec2ad6a69044b1be5e30cb0fa9994e661dd5f8
MD5 3a366488405dfa24dfbdc2ba3bb32b1c
SHA1 c06767860262e403dccd956eaf6428647878b93d
SHA512 3df718032bd8432d9023fb95865b05e0dd5f16e7763113727c7c9105d218863e690463c133b2bd79fd46be13f4b316f263d6a1150d01a2aa0464ce1e38d41ca1
TLSH
T1BD3136A7C3E8866D891116F0BA647D27DE5E091893283D27C9E4AF4BD7F2461D20464E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7bb0b5d2ec118f153905c2e1642f7cbc73d66ca7af1b4f25e15bc416b65a5c6d
MD5 4f7ac54b3b9dec8f0044997471ef8c3d
SHA1 de560514c97d50a6fe178cb53548402cb3eb4b36
SHA512 9afaf17e726c9729770f2779770d92e11ae92f69f47100652174a89ece023e0a8c0f52ce2b040946e8f30c0b71cf7b7ffa27cb8fc8aa487f3f67ab140372b3d1
TLSH
T1DE314AB783D8866DDD1156F0BA647D2BCD5D051853283D2789E4AF4BD3F2461D204A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5696cb658e6a84e1957a9bb39053aac51e9db11944718cc4401fb70185d48dd3
MD5 6b5e0c8a65fe0cc26c49f9d9b847742d
SHA1 86e5ddf4f3840cfec2a6e2caf229a78efaa8f4f4
SHA512 88aa8899783a9a548da39ac2684cd529351c0816802e246d68121b771d412b92d0bf454338947c659d6716174935cd0d7351eed9a27b4a21bfad889767c5b110
SSDEEP 192:sxZVtar/ywFaKOMl8UQYckY//f4PsYtbQEVS+ZIupRV0HW6+WNwVj6XY4MfVSip7:sxZ8Xqqo/fCsK90ccHbrXHRM
TLSH
T19D52F9526A349AB78CDBD209FA45BF53E6F41472D2940E44AAFCC60C05E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 384871f4598802c2d9b7eda06727702b699c8a2095d12b08fa2da078451b358f
MD5 48aa51a214a586bc199be0087ba946b4
SHA1 fa84f4fa42f39aa38719a5a44965dcfa89297c8a
SHA512 b39e0f44a9733370258cf33c35bfc45928feea5a41a27e7528690bfb14be59c8c3756f955579304d469e4dc28699fff56ace9203d80b653ff02ade0de5dc140d
SSDEEP 192:sxZVtar/ywFaKOMl8MkY//f4PsJgEVp+ZIuprVXHW6+WNwVhz/Y4M9VHipCu+Ig9:sxZ8XMo/fCsJZjcVHbU/o9
TLSH
T1BF42E9126A34A9BB8CCBD209F945BB53E6F51572D2900E44AEFCC61C05E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b3176eff38f948f5eb46a5bd2f0110b25a2634f535b3e8750c430fba14f4ef79
MD5 43d7385241b04862b1458513034a4977
SHA1 ba59a1b65a1180dab66b4ccebc15da5db0dbacbf
SHA512 6d65c3c8203d7e4dc1459ca457b476c7712adf089a25de1eac5f328471f25af88ecf7b330a366bd6a0a2388704f0bc480c9d799ab80b2524d773d052f09d6d77
SSDEEP 192:sxZVtar/ywFyEKOMl8UQYckY//f4PsYtbQEVS+ZIupRV0HW6+WNwVj6XY4MfVSiO:sxZ8+qqo/fCsK90ccHbrXiRM
TLSH
T17A52F9166A3899B78CDBD209FA45BF53E6F41462D2904E44AAFCCB0C05E7BDC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 196f1945b1fb664483366de3cc580f5220c823e984209e2e41308ab5fbf21ecb
MD5 eb146feadc2a94b8fdb3947085c39501
SHA1 ecdfa2a9a057feb97ae148ddbc1d9d5d7129f738
SHA512 32acbe83b41049609ba8582e9b5641873a50c795675258661b06cb952df7f457b97ad8cd48c2af8a065113c72ce404c7b2f8849cccc39186488fbfb9ddef26de
SSDEEP 768:PoEPO/KWvWeI58F1+UoAYDCx9Tuqh0VfUC9xbog/OVdqLlBHu1croAjGS7E:PoEPO/KWvWeI5u1jaQqLXO1HrSY
TLSH
T1CAD20A2B680CC77E4F840E9DEC26AF966ED801CB67984D5447FA884C03C77EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\67e80507-316b-45f9-8f16-d70efa58e597\index-dir\the-real-index
Size 1KB
SHA256 dd0a1af979ebfac68d74b0663da76a5684c678bce0380a6e8bc402e402a12963
MD5 a050d4cb0e50dd119d404cd48f2182c0
SHA1 49f3fcf930adfb1c0faab451686b4f3dab2d77f3
SHA512 aee7b0db91bd10133ccee04e78f82830e53fafaee271c77a6f388de68d7639119e530733cfaac956cc334f6ddaed5a6da8acb916aa9ef7704dcff57389cd2e97
TLSH
T12541A58E8D64D56FDCA444B2117624A437F0CADC1B62A2638CBC263A7C6736E1D4F298
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5dab56.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\67e80507-316b-45f9-8f16-d70efa58e597\index-dir\the-real-index~RFe5dab56.TMP
Size 1KB
SHA256 46f7d5f3cb5c51a84960d3d6284b2fbbcae5e1fd212dc1f99f4b55f494bf9168
MD5 4a717b0efbecb42146694e99b4902621
SHA1 1ac4c85f610ece2880dd3dc36a8f5ebcdc41f735
SHA512 9a659f8da7795549bbea36fce6330f9833ef50ea417cc7c660a8374778641e02f65e7389d104586087891669f1b2961f21a6a1fbc566f2f5d256fd0578760d48
TLSH
T12F41878A4D41951FDCD0407206D3A4B83379D90053217787A4BC523AB8B57BD2E5F1D8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 0d6fad6d97b8d388bc3a77e9709f94c62cda9a978ec13e392247e2359f48507c
MD5 1dc1913a30e80c63dd1fa4a24f5f5086
SHA1 ffe5db1269af7dd2fdb6f50f073878408b345f4c
SHA512 0df27208ffec1e3a603c83bb3a0eadd4a09c8bad46f4cf628b3a2aa8239d481c00e52c069ed550adecc4689cddb70a5bcd121b9186247921bdb52515f0c49118
TLSH
T1E3E068B63CB72C10FC6BC3C6A47058A400167A688600AC8F141AA2CB30E1328344EC71
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0d69f64765a8d5ef191ff81a46b7bc6365b277d35fb0497e99ea002201d963a6
MD5 b3570d59eb183017bb8e13849e1b596c
SHA1 11b8711787cc0d185c12d9cdf37b4a25ce31b6e6
SHA512 d54871becd0356389b5cb80da35caacad8eca480b7e51df44b991930a9c3b5e621556b01e8b5cc2d92d1425d90d3e09c657b3d480293bf78d90096291406f7d2
SSDEEP 96:KpxAr/JvLjgbiS2HjKO62Vjah5ajrgrgHcAGOOeg+NF2geKOr2CeaIglStvyKgE3:KH5PJu
TLSH
T1C2A1C252353B724238BE368891A6D53A4E9139A3305CE46F77B850B64FA7E500EFC8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a8936b08dbbae2d0e82bda188112b35edab33a62486d016feb6ab37ab86650ea
MD5 c8b473f88766c4fc2411b6998dc12065
SHA1 4ffaaa2a5bd8aedd1cd8632252ea14fe5c7f4461
SHA512 9f77f66e55cdd81ec9817e0408447af5f434199b10af65881a7cd079fdc47d2191e3e8357259590e617363c985cd746bde928d6afead93c0b1c2080fbe6607c0
SSDEEP 384:utNn/s3n9SfsNYkoVWDD7VXq6TOXa2Vemn15wbAjEXvc:uj+9UcxVOq2Vemn12bfXvc
TLSH
T138927C36A8685D371DD39589F447360B6FB8956BD7843F9485EC4F0C01DF29C131AE2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 da73f0b9b5520c2093d2fd33eef693cf20a70e7723390e834a8e81047a727823
MD5 8dd75d8d0fb1159e136d29f48c36202f
SHA1 2d835239f906a869676fc2a3a00d545809a8290b
SHA512 dc158e5449d726da4ec81c6175e3d4ecb45178d4075e44eecc2b6035ce1d58bbf04517de7ba45cf44c8593a130256ec75e18535e8b097226bb5a81e856770a45
SSDEEP 384:ytNn/s3n9S1zsNYkLVWDS7VXq6TOXa24emn15wbAjEXvc:yj+9mkxVOq24emn12bfXvc
TLSH
T1DBB229F254E75932D99E9347B37E2E075EBCD027B2842A40B7D84A0CCDDA27FD209916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e2ad917319324da6e798e5635a1cce95a8229bbabca2f1221f60b78ef75efa40
MD5 b949fe06f5a6ebfd202e7cc840521ba8
SHA1 c53a8450b7429c52387d8619374a499a69a5f142
SHA512 a4f3c39e3fd9f1c7dde07fbc7c44ae7d679af9d36274e88d63f98317d643fad8fbd30e082abac24718c649434aa9ee04c8ade16e6466df90f5427d80d3df93e8
SSDEEP 192:mONg6rvoQmiUyVmKV8DrKhD4XqMB/1jBOBRURH4ExigOU6:mONg6cl+6Xq6TOXaJAU6
TLSH
T16902E735A9686C779AE6AE49F0873B176FA4212BE9857F80DAE81F0C00D765C1306D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a7168e38c58d45fd746e1c0bbca5b6ae165fd5ab28d55e60506b68e674b98f66
MD5 b1853c13721c35d914b406c33c332ffe
SHA1 9115a2e476f4a1b018bccd6192518924f0715e10
SHA512 1baa1ba6d2b543aaeedba58b53655cab14c8cac517fd893a86846181bba7d10032e07bc2313b1c5038716dac81849ec9adf1867872bbc4fd7521730e07578c34
SSDEEP 384:EtNn/s3n9SfsNYkLVWDD7VXq6TOXa2Vemn15wbAjEXvc:Ej+9UZxVOq2Vemn12bfXvc
TLSH
T12E927C36A8685D371DD39589F446360BAFA8956BD7843F9485EC4F0C01DF29C131EE2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dc082fa0538e2ea58b14cb8069a43e56824f43a9d84e32ffb31ed22fb86a0516
MD5 2cbd3dbe4a0c2f1d4f1c1f031b738a70
SHA1 5cae83e73612f6947ac5c3fb292cca3fa9958ac2
SHA512 ce896bc0ff2c9783048d1edb7de8626ab11ed6b1d294735885d0028af7251205fb37c03ebecf8ad2933b3a1f2a31ba8a5d58dd332cb99344a2df8d29eb4c5032
SSDEEP 192:ftONrh76rvRHQmiUyV9V8DfRhD4XqMB/1jBOBRURH2HEICiPqN8U6:VONB6XTZ6Xq6TOXa2CeU6
TLSH
T1C0120936B968AC375DD2A585F08736035EA4612BDA897F80DAEC2F1C01EF56C130E927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 36ec9f60adc70cc8b813a6a86592560851a1fe2f20336d49e5905b55c11bf407
MD5 482a58c1cf8ad5974938b79f0aed467e
SHA1 ea354fdd853cbf0cacd3db1cf2c363fdfbdc9633
SHA512 dc6a6b36aca47f5c61e31ec896b4f42c1fc0c6a60397da11ec0703290ce0b0398ec90552e81c1f210e2f9aa3a595c12710fe091241aa25b6d3dfccc6de36a0c3
TLSH
T1EE41E958A6F91148B3737E56AFF2A86E487F79772E06C4AE10010E8F0B22B40C961777
MD5 SHA1 SHA512 TLSH

Submit Download