94222e941196e4f126df5a9928dc6b47d9f075faba78249c787dc160abd03148

Analysis

max time kernel
900s
max time network
736s
platform
windows10-2004_x64
resource
win10v2004-20260513-es
resource tags

arch:x64arch:x86image:win10v2004-20260513-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
03/07/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bin/citizen/system_resources/monitor/panel/index.html
Size 1KB
Sample260703-2d2x9agy91
SHA256 94222e941196e4f126df5a9928dc6b47d9f075faba78249c787dc160abd03148
MD5 32645b0fa6f24e19a8b6c8fa78bd4aa7
SHA1 f68ee4a21a1407ba246758754c3eefeff68aea6b
SHA512 2914f76e2a2f23e169bc540082ff04a0e046213fdb8c4eb7c10b66f25609d9b6d90108cdfe24cdc2a10278ba9fa1ba4071a59cce12138923009ede330a8c5d7f
TLSH
T1ED3161038EF09C291225856959D2F008EB33864BE7083820F2DE45DF0FD2FD2E8E7698
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4916	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275922967633915"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{860066B9-B8F9-448F-9CD2-0C9922E4C79E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 3400	4948	msedge.exe	84
PID 4948 wrote to memory of 5076	4948	msedge.exe	85
PID 4948 wrote to memory of 4916	4948	msedge.exe	86
PID 4948 wrote to memory of 5076	4948	msedge.exe	85
PID 4948 wrote to memory of 5076	4948	msedge.exe	85
PID 4948 wrote to memory of 2844	4948	msedge.exe	87
PID 4948 wrote to memory of 2844	4948	msedge.exe	87
PID 4948 wrote to memory of 980	4948	msedge.exe	89
PID 4948 wrote to memory of 980	4948	msedge.exe	89
PID 4948 wrote to memory of 980	4948	msedge.exe	89
PID 4948 wrote to memory of 4632	4948	msedge.exe	90
PID 4948 wrote to memory of 4632	4948	msedge.exe	90
PID 4948 wrote to memory of 4632	4948	msedge.exe	90
PID 4948 wrote to memory of 3912	4948	msedge.exe	91
PID 4948 wrote to memory of 3912	4948	msedge.exe	91
PID 4948 wrote to memory of 3912	4948	msedge.exe	91
PID 4948 wrote to memory of 4508	4948	msedge.exe	92
PID 4948 wrote to memory of 4508	4948	msedge.exe	92
PID 4948 wrote to memory of 4508	4948	msedge.exe	92
PID 4948 wrote to memory of 4100	4948	msedge.exe	101
PID 4948 wrote to memory of 1232	4948	msedge.exe	102
PID 4948 wrote to memory of 4100	4948	msedge.exe	101
PID 4948 wrote to memory of 1232	4948	msedge.exe	102
PID 4948 wrote to memory of 2752	4948	msedge.exe	104
PID 4948 wrote to memory of 4576	4948	msedge.exe	112
PID 4948 wrote to memory of 3532	4948	msedge.exe	113
PID 4948 wrote to memory of 576	4948	msedge.exe	114
PID 4948 wrote to memory of 2580	4948	msedge.exe	115
PID 4948 wrote to memory of 2580	4948	msedge.exe	115
PID 4948 wrote to memory of 1416	4948	msedge.exe	116
PID 4948 wrote to memory of 2936	4948	msedge.exe	117
PID 4948 wrote to memory of 2936	4948	msedge.exe	117
PID 4948 wrote to memory of 4720	4948	msedge.exe	118
PID 4948 wrote to memory of 4720	4948	msedge.exe	118
PID 4948 wrote to memory of 772	4948	msedge.exe	119
PID 4948 wrote to memory of 772	4948	msedge.exe	119
PID 4948 wrote to memory of 640	4948	msedge.exe	121
PID 4948 wrote to memory of 640	4948	msedge.exe	121
PID 4948 wrote to memory of 4912	4948	msedge.exe	129
PID 4948 wrote to memory of 4912	4948	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Bin\citizen\system_resources\monitor\panel\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffeec11c188,0x7ffeec11c194,0x7ffeec11c1a0
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1900,i,9754457258126380880,14003093333446132866,262144 --field-trial-handle=2284,i,10934393421105788862,91831918475761304,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2040,i,15202612359696650389,16068051150629576489,524288 --field-trial-handle=2284,i,10934393421105788862,91831918475761304,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,10434927247103240808,1228210354587368584,524288 --field-trial-handle=2284,i,10934393421105788862,91831918475761304,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,2086536374398990777,15807051517621428047,2097152 --field-trial-handle=2284,i,10934393421105788862,91831918475761304,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,16115179328340368939,4203676330336498267,2097152 --field-trial-handle=2284,i,10934393421105788862,91831918475761304,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,1301352108071312724,369706287050448593,2097152 --field-trial-handle=2284,i,10934393421105788862,91831918475761304,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,12022771034114674784,16889475979520619675,2097152 --field-trial-handle=2284,i,10934393421105788862,91831918475761304,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,10626852204120730434,17009537069926971204,524288 --field-trial-handle=2284,i,10934393421105788862,91831918475761304,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,14529379177488714739,2737416097908650684,524288 --field-trial-handle=2284,i,10934393421105788862,91831918475761304,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,17082838200574983446,12599341837241026115,524288 --field-trial-handle=2284,i,10934393421105788862,91831918475761304,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,17082838200574983446,12599341837241026115,524288 --field-trial-handle=2284,i,10934393421105788862,91831918475761304,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,15518604282172179912,3403223159023429884,524288 --field-trial-handle=2284,i,10934393421105788862,91831918475761304,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,18059767928759824028,14166316016306873833,524288 --field-trial-handle=2284,i,10934393421105788862,91831918475761304,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,12269806756431165443,12749950210609754003,524288 --field-trial-handle=2284,i,10934393421105788862,91831918475761304,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2748,i,17937417523529738071,3957484124706562718,524288 --field-trial-handle=2284,i,10934393421105788862,91831918475761304,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6032,i,13512977633602503362,2021201241974411888,262144 --field-trial-handle=2284,i,10934393421105788862,91831918475761304,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,3470767472059887583,17178098159805055031,524288 --field-trial-handle=2284,i,10934393421105788862,91831918475761304,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,13735942698871080780,15110237441337435451,524288 --field-trial-handle=2284,i,10934393421105788862,91831918475761304,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,5105997288158057112,4540781807436010132,524288 --field-trial-handle=2284,i,10934393421105788862,91831918475761304,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3380,i,13562073289862882078,13205872044361928239,524288 --field-trial-handle=2284,i,10934393421105788862,91831918475761304,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,550471892221009389,7467064996196337541,524288 --field-trial-handle=2284,i,10934393421105788862,91831918475761304,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 64d29c72aa2191a8edc98ce38f52b0eca67a2e412d7cf96ab03de459ffadc104
MD5 24a70170ff8431acad0fefbae3f77c33
SHA1 f284aa95d02a55f83142dbfa5d7addd7e2cd2cee
SHA512 e70f701be4c563cdd514c97ceb6abc44edd63d7a4123928557fba102c6008ba3935d7117ba02254d228955846377796765f5dc7444a30150fd1e92a361d9f59d
TLSH
T1FCE020CE17C4C35DE10C64475374471C47C03A1A92C46A855711C4D83081988FBD19F4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 975a37e20cb21b7dbbda612a4bc77c38907174ba15f3c01bc996c404c459f72b
MD5 df70a4c14272083308a8d4bdd951182c
SHA1 1dc11fd40ad488863622ae46bdeaef6fc5d5fd27
SHA512 a10a8e6a00e5a287b69cf5bab8e938e2fae6510ffa04394da65276bd611e3d63eaf541ff390813c268e699c947419931d5b0bc966c41050bdcaf96bfcbc4b736
TLSH
T124E0D80E53A0C2E4B10E9B4F92479B245AC3FC5BB9A89AD9B21B605C3481388D7918F5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 54172fb573e576c29bb0dc5d206e2eb70fd4c6c551e7bef524fe5634f08db71c
MD5 7f7f4113f60d5483c42fa758bd4a1db0
SHA1 cdfbb5b01b34ce86771b5cec719601b21aefb7aa
SHA512 08a8a08d5614b07c8c548cc3a95ee1979de9c0d7e59c5197f7418b4469ecc6f7d4dff28c9a688461352e4b39fe070da2f7024ca7d8cb8524972596a73880a8d1
TLSH
T145E0201C73B0C3D435289557D27657588DE07217EECC86D5F615F054248319C5FD11F5
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 276B
SHA256 bc40fe32ff83cdf9384b76b530a250d6026521bfa4f65dd197dff408074d75d9
MD5 87fd7b094830afce37f3f23cb0fb777f
SHA1 3fc1925a7b7468e0d74c06dc8804924d0c211f2c
SHA512 810658077fec7b278b971052494cfd213d53edc3d2e9e2c7bcc7481907278228e5a2ddfc1913f32c3daf3a0d60c297dd0f1e832b686a7d4f4e70d8f5de6710af
TLSH
T107D02BAEBD8C998FD7D11CFE8732F0000B9565A2D42FBB130224FDC43281BB01E29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 88c79e8cb8919e5103e3a5ee95f48d0fb4b7879cbf85ea853345c7455ee5f500
MD5 d7b69cc29d8eedfa9d075a897fbb874e
SHA1 23c2013949ce4d95e612045ac3badd8fe9910e6e
SHA512 06189d8a11d579d628b5480dd53a222111c266fb67ec9af9e8b130958e2eb79fe8f6dc62388c6767991dd2d04d23c8f5a4f3ec835672b013708f8884d36dfda4
TLSH
T1A97161890365C4F0E7A006719BD922F137B3DB6D75FBDF491C82A970A60CF52C1AB829
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 9be535ed568a139bb3c90f462fbef0d4a24f7fb433d850ace4ade58aa039e9fe
MD5 e7ce002f545c1479c095bede5395d736
SHA1 9b4bab34582419ffe485f5978251561e29e5a31b
SHA512 32970eca102e80ec13686c191925853583297d9a92c4ba912c5d8db06a0d4c1379bba90aad32d822f011b393de61f0c64f385ff348a200ec7c79eae0acb1ce60
SSDEEP 1536:TfEEjWlttjpGZqW3ynPDuVLpBO6CvBcZs862UqPq:gLlEt2BmNUH
TLSH
T180B36227D6A64C6B01F16264EC754383F325436F9286A82F3A3C5D5C2FBD93A6502F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 644B
SHA256 17a81349decdd723ad14e871454ece12afc1739a9ad16de82b448904a09dccd0
MD5 d8161a3fdf3458605f041790b0864bbf
SHA1 d2b939a86bc008c69774e2ff78fa3179161a4f10
SHA512 35561a44db5ec50fcf984495d7906c387bc41e4ad481ad73a901a9df473fbbdbb8e48c35bc12be41a42e9db0d10340a8530199264f68bf5f211d94b87bc8c190
TLSH
T119F09EF383E0556D8B1181F0A9187E1BCE290402431C3C5696E0AE17A3A2464E001D4B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 839B
SHA256 021f76e614b8a7d81bc6eacab9ba88b09002bb4da4469dbbaea8bf8374c6a8c3
MD5 38f6e8666f1be2c9bd83317d900b7de6
SHA1 d39d4a338145d296d24ea21c48d97688c7a125fd
SHA512 1df649ea6802bafbf8ecfaa30ab75e916b566863c83a178826c1727347318203ccb0a19d581574d7a1d8e507e61573c64c6b02751934a51b357215c022d3b7ee
TLSH
T1D201C2F383E4456EDA2141F099287E1BCE1D0441431C3D5685E4EF1793E2064E002E5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3d400091ee4be16744e54f83b051ecb0aeece91e0eb740a98a4fc4dd285cfbba
MD5 2d14d5e7bdb67ff692cbdd4ccd612661
SHA1 9ed092135e8c626dbf49b67c7d22955437e8091e
SHA512 d9d36d7b33674f6a238a6f9a87dda900968ff03b77dfcfb7089a8ea0df9d1f39a8e594ed059400f9b65b7ce6ccc6f9102a162e67a5f7faab21d4a144db6c8c5e
SSDEEP 192:sxZk/ywFaKOMl8MkN/fbsQAYWzVfIupdOHW6+WNGYvroPFnIgrJ:sxZkXMN/fbsQAVtIHbGlx9
TLSH
T1EA42EA166A34997BCCCBD209FA45BF53D6F51572A2940E48AAFCD60C05D76EC2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 402a9159333061b5deeafcba0fa35a28c46b0e1e0251b816c56d01b94476a5ac
MD5 51b15e421b5ea65e33199e40d96b8ce3
SHA1 06af7dc02a7e742d10f86cde54a0e80dd2ca369b
SHA512 df494d25c3ea4f917bef9a8f3f3fa042939a8a00d947b05bdf1d9bb8612ba5565f764abc7cb0f828a12d6ba195dd3383c55d2204ea6ea659ec2ba00aea9b81a8
SSDEEP 192:sxZk/ywFaKOMl8UQFkN/fbsOAYmuzVfIupHOHW6+WNGYvM/YFnIg5oJ:sxZkXqON/fbsOAHutuHbGcxW
TLSH
T16E52E9566A3499BBCCCBD209FA45BF53D6F5547292940E44AAFCCA0C06E77EC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6ccf220dda2dedf4ddb0f832b01d9f0b873acbb82f4fb460d37ad49eccf8001c
MD5 02ae0e6a7d7a1d0426d65c3d9acb16b6
SHA1 9f4c284ee50e719ff11b5ce80a03566ba3b7e9f1
SHA512 542cfe7d63c87c2e08efa597a01637ce48023049304f9001e824aa04301901d89138cf691aad0c4d88f9d88f384ffa9f2beb3e701c0228713dc1b503faa057ef
SSDEEP 192:sxZk/ywFyEKOMl8UQFkN/fbsOAYmuzVfIupHOHW6+WNGYvM/YFeIg5oJ:sxZk+qON/fbsOAHutuHbGcsW
TLSH
T1ED52FA166A3499BBCCDBD219FA45BF53D6F9146292540E44AAFCCA0C05D77EC2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 cd507c1e93b07c6c31745fc0c1d7b3372eed5cd66cf38cad6e6f55310d6cac2c
MD5 f519f5b329b0cac9fb3f5bdc536288ab
SHA1 d8dc1367e1b961d99e9d2d6cd1e844216973ba34
SHA512 e7d8ba9f6e65889442ffa931615d5eeb9edcf1b38dd4666b96386c2cec476f872906f7a7d8c7df9a23a5a5107f887ac05795b2a79615df2bbca60a52a5d53374
SSDEEP 768:CKseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLcLly0pphrofZ:CKseJ3xWvhfynu1jaWcL88pah
TLSH
T17FD20B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA884C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 936B
SHA256 4591674051176d5367e6e5f5822d95028f416bf5360e951f98d4126d13ed2481
MD5 4e9fe15cab52daea9b6347989fe2476a
SHA1 3ed7fd0af6cc8fc3f6598a798f855dce5e9f0f8d
SHA512 40ed5da9c4f5b0b0f05f82e390e57e363750f707e876721c132f31a9110cace5d90533e48519bcc25858be4cdacff20ecdb1bf3afb389fef3b0fa9d5dd3d9969
TLSH
T11411F4055EA14D1FD95805772DB9B0F4737049DC5321A277686C19762C2B39974471DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cf034.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5cf034.TMP
Size 936B
SHA256 42090b5a1dda3bf09d4cb33d18b8b113be1253457a0f21e03a5d66e186fbd7a3
MD5 a66d353ba5f2b088da7fb02474ee1f98
SHA1 98fc3e766da1288da18eab76050da1da99a769c0
SHA512 b45e5bf31b936655b216a71d28e45a5b242b4c7b4970f5fa98447df7de7a92ae27fb45b2201da13457596b264c25205c457f9755cf4175cd418211adb0b667bf
TLSH
T1AB1123464BD24E1BD85415BB1EE6A0F8F3308C00A322F7E3746C193A5C767CD59061CC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 d156d067039f408f4a76f43ee204f3654a6df0673cc5ddb2a9645356f888228c
MD5 7c7ba084de8eff31e6eade119073868b
SHA1 33e35c776d2534c4a2d25ff21726e005988a9b3f
SHA512 c295e5390b5247432e146289b5edf7751e83bb1cc34ae23c99dd8f340f0c2e0a4e37e1a7936ab50a358e8d2bf9e4e858a8c5545751e95d79dc40774fbbac2bb5
TLSH
T1A2E0C6B62DD32810BEAFC3D220308490064A78ACE945FC0EA42FF6C310B231530DBC36
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 d9310998f8bfbe30b1594d49182be3ab894ad8893805e81a38b0e94f841298b2
MD5 54ffd7d2c61ad0300f6516ca56aa5d4a
SHA1 9eb51fb45b066f0979e8cd1a3a98bac83b5a13fe
SHA512 5038323335881eb691f2b485629b32581adc894406ff755c863fdf68e242ac80ac3e6ff2d3c3b5ade7ad7b4ec36091b4d55f0d1cd27b6a469fdac610ca1563bf
SSDEEP 96:KYH+KggmGhCKaMqGJqKakyK2EKDSZnwVRnC:49Z1Rt/0nwVRnC
TLSH
T118C16006353A02023C3E354CB6E69B375E8171A37024A5AFBF7916564E6BE114EFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5fbf05de-56da-4ecb-a705-cfad900ee824.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5fbf05de-56da-4ecb-a705-cfad900ee824.tmp
Size 22KB
SHA256 e7dfcd2af3cefc7ce57f7bf6991d35a5d20958cb42766f953d9e1c76fae333b6
MD5 5cb2b7e81b4702abd9866dd283d10b96
SHA1 5384d524ca48437435a367dbbc158070ce70493b
SHA512 c5558f99f45f9b2e4cc7c7fd80211556401a16d808a8b34aaccf6cba23f5b5a5e834235a19cf251015bda0baa50c8bea1b0a20624e7e483f5a039e0d86134f85
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uQ:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAZ
TLSH
T168A2B81DC81C7E3257CA2F7D6A2F9DB276CA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 b703d92cb295d8de2f49defc4a057c617f72404c9200201844f79b8f652e1086
MD5 47b25f6ec78f2f7673d7acb96f5b2158
SHA1 dfc93b8b3a4f87821aaea1dea7eeff71bce57a03
SHA512 9be12ebea84970e4269bb8ee168e45c5e88e080cf441918fb02b220a4a40774e655e8a1cae545de2edda7475ceb62b50e231e688c1f63224f76e718fc69e6360
SSDEEP 192:ub2TSNWMsnMcPPQLz3XX9VofsNRWQKA7M7wMoQmiU1dn9q4MTWCgH8KTO8z1oqcB:TtNn/s3n9SfsNRWr7pIR1kgzKEQ
TLSH
T1E7626C76AC295C6B9DE7A284F14B3B175FF4816B92C42F50E9DC2F0C01DE26C030BA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 3392804bfece729572b7ecdb2c8f0da3439c2f30fbd328241ddd9197ed25ff21
MD5 c27b39f8d900802cca38d06633bd3e28
SHA1 1640b4a530e4b20711449224bb84bde0033e8755
SHA512 ac7ef16024726cf6f7ad257e7310cdb120f5dda9e6c7a7c8cbb7ac49a9f68c8545f9e04eb360bba69e3e9c92cc74a08fdf36194c967d5ed47cbdcaa8a4c8c52f
SSDEEP 384:P67F1tNn/s3n9SFzsNj8TUNTUlIlnr7pIR1kgTKEQ:yF1j+9e2wgt6iQKEQ
TLSH
T152824B739C588D7FAEE69B84F64A36178FF481A7D5C46E50E6DC6E0C01DB1AC030BA19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a05d81284a0f307c52d7dc69ed02842b04d5fe604341503db3db4ba1c9a17f95
MD5 40a31fb0c655794f04240acbfa0f3fcb
SHA1 0893e9d5eb3a2e009d8604a5c36e6e3e8f9ba949
SHA512 4e07c2743957998d1f1db6ac17458b5945ff0f9e151730399b112080f6dc783ca4f7899ed4f8b23c1fef333653b7d75134a3d302a8ce5a442de8b87dba412a50
SSDEEP 96:eqONkiQsjpflMoUZre5ih/cIPURHl8h4otop59OD1BjPYvlCr5pgz6qNGe3cAgHc:lONm6vMtPQmiUyeLThTWCgH3847SSU/u
TLSH
T188021936BC685CBB9AA3BD45F48E27171FF451AFE5905B50EAE82F1C00D765C130382A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 9293da2614a0a0c8d3a636762505f9b60b0ba20ce8e0449a820ff5cebebe63c2
MD5 753ffe37d8cff931244cddeb7d1fe349
SHA1 20d9cbd2979298b3c1a45694cb242ec90c709bf2
SHA512 9ccf1ce7ca580940dc8abbdf7f9e11151a80b0dc7c0717394f420227146d40d0e8f118a7e1297fbd428a251b477add8ce4b9565738aa3ea3c9a67878233849ac
SSDEEP 192:ul2TSNWMsnMcPPQLz3XX9VofsNRnQKA7M7wMoQmiU1dn9q4MTWCgH8KTO8z1oqcB:9tNn/s3n9SfsNRnr7pIR1kgzKEQ
TLSH
T107625C72AC295C6B9DE6A284F14B3B175FF4916B92C42F50E9DC2F0D01DE26C030BA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 56bdc5ce07ae077b0075217df7dbda09186feac5cd7019c0ec4d1ab3bdf70323
MD5 1bbcf7883cad28e76f629ac653db6735
SHA1 865226f36612e66bf92d84da2f2b40eb3bc01ab7
SHA512 bb1774446e86e2a6b61f9c4ac51283a89c168c1a33c5ce1cab343395e799e076dbfabb4ab691116ad80e3a63f53ef2320ae9f30eb3989b45f858688b11327510
SSDEEP 192:aONM6vM6PQmiUy0LHhTWCgH8KTz80IoqcU/u:aONM6U6RpHbgoKU/u
TLSH
T1B6121A76BC689C6B9EA3B551F08B36171FB0916BE6846B10E9DC3F1C01DF56C130B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 03f04f638f2f92d0c8cb8b635a0d25c663eafb6ab6c94d74e8866cb4a566bd4d
MD5 bc6f43bbec52a39b8b5c46c011c40c81
SHA1 84b4c703c030f71722753aee1673e39db58f9b5d
SHA512 1a0149af8f45f2ce1412673f0c084b9cfb34d6c86e89138d42bb0e740d7d840bba0c99dd51a71cf270aab6bb8e05ad552e52022353e2c59952cff76cff3b942f
TLSH
T13841F859A6E9114873B77F5A9BF6A86D047BB8772E0BD46D10110D4F0A22E41C961B33
MD5 SHA1 SHA512 TLSH

Submit Download