94222e941196e4f126df5a9928dc6b47d9f075faba78249c787dc160abd03148

Analysis

max time kernel
898s
max time network
746s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bin/citizen/system_resources/monitor/panel/index.html
Size 1KB
Sample260703-2d2x9agy91
SHA256 94222e941196e4f126df5a9928dc6b47d9f075faba78249c787dc160abd03148
MD5 32645b0fa6f24e19a8b6c8fa78bd4aa7
SHA1 f68ee4a21a1407ba246758754c3eefeff68aea6b
SHA512 2914f76e2a2f23e169bc540082ff04a0e046213fdb8c4eb7c10b66f25609d9b6d90108cdfe24cdc2a10278ba9fa1ba4071a59cce12138923009ede330a8c5d7f
TLSH
T1ED3161038EF09C291225856959D2F008EB33864BE7083820F2DE45DF0FD2FD2E8E7698
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2948	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275923646208477"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2132828192-1552876075-2324613956-1000\{B3E96114-0F39-4DF8-979A-875DD146B1A1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1932	msedge.exe
1932	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 1232	1244	msedge.exe	87
PID 1244 wrote to memory of 2948	1244	msedge.exe	89
PID 1244 wrote to memory of 1420	1244	msedge.exe	91
PID 1244 wrote to memory of 1420	1244	msedge.exe	91
PID 1244 wrote to memory of 4932	1244	msedge.exe	90
PID 1244 wrote to memory of 4932	1244	msedge.exe	90
PID 1244 wrote to memory of 4932	1244	msedge.exe	90
PID 1244 wrote to memory of 2964	1244	msedge.exe	92
PID 1244 wrote to memory of 2964	1244	msedge.exe	92
PID 1244 wrote to memory of 2964	1244	msedge.exe	92
PID 1244 wrote to memory of 5652	1244	msedge.exe	93
PID 1244 wrote to memory of 5652	1244	msedge.exe	93
PID 1244 wrote to memory of 5652	1244	msedge.exe	93
PID 1244 wrote to memory of 5508	1244	msedge.exe	94
PID 1244 wrote to memory of 3916	1244	msedge.exe	95
PID 1244 wrote to memory of 5508	1244	msedge.exe	94
PID 1244 wrote to memory of 5508	1244	msedge.exe	94
PID 1244 wrote to memory of 3916	1244	msedge.exe	95
PID 1244 wrote to memory of 3916	1244	msedge.exe	95
PID 1244 wrote to memory of 5564	1244	msedge.exe	98
PID 1244 wrote to memory of 6120	1244	msedge.exe	97
PID 1244 wrote to memory of 5564	1244	msedge.exe	98
PID 1244 wrote to memory of 6120	1244	msedge.exe	97
PID 1244 wrote to memory of 3568	1244	msedge.exe	100
PID 1244 wrote to memory of 3304	1244	msedge.exe	104
PID 1244 wrote to memory of 2100	1244	msedge.exe	105
PID 1244 wrote to memory of 2868	1244	msedge.exe	106
PID 1244 wrote to memory of 1000	1244	msedge.exe	107
PID 1244 wrote to memory of 1000	1244	msedge.exe	107
PID 1244 wrote to memory of 1932	1244	msedge.exe	109
PID 1244 wrote to memory of 5048	1244	msedge.exe	110
PID 1244 wrote to memory of 5048	1244	msedge.exe	110
PID 1244 wrote to memory of 5396	1244	msedge.exe	111
PID 1244 wrote to memory of 5396	1244	msedge.exe	111
PID 1244 wrote to memory of 1556	1244	msedge.exe	112
PID 1244 wrote to memory of 1556	1244	msedge.exe	112
PID 1244 wrote to memory of 2284	1244	msedge.exe	113
PID 1244 wrote to memory of 2284	1244	msedge.exe	113
PID 1244 wrote to memory of 1884	1244	msedge.exe	121
PID 1244 wrote to memory of 1884	1244	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Bin\citizen\system_resources\monitor\panel\index.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7fff755dc188,0x7fff755dc194,0x7fff755dc1a0
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1868,i,3441121353203403900,2783721011075867507,524288 --field-trial-handle=2308,i,3483231892443040428,8054374310139469044,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,4462134904817959756,3155808647439985120,262144 --field-trial-handle=2308,i,3483231892443040428,8054374310139469044,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2484,i,3098102216860527189,236219257931369459,524288 --field-trial-handle=2308,i,3483231892443040428,8054374310139469044,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:13
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,4240587973529333724,10170995625146985486,2097152 --field-trial-handle=2308,i,3483231892443040428,8054374310139469044,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3368,i,2638232751669770036,10296252744891857735,2097152 --field-trial-handle=2308,i,3483231892443040428,8054374310139469044,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4348,i,1114086385348089142,8716929351690886443,2097152 --field-trial-handle=2308,i,3483231892443040428,8054374310139469044,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,10602081067823097976,6696521609683297431,2097152 --field-trial-handle=2308,i,3483231892443040428,8054374310139469044,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:9
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5360,i,6646660166167505811,10657610616001647048,524288 --field-trial-handle=2308,i,3483231892443040428,8054374310139469044,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5344,i,3361827299144427151,11087890622414102864,524288 --field-trial-handle=2308,i,3483231892443040428,8054374310139469044,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6072,i,17578261371083939391,16635729815147337280,524288 --field-trial-handle=2308,i,3483231892443040428,8054374310139469044,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6072,i,17578261371083939391,16635729815147337280,524288 --field-trial-handle=2308,i,3483231892443040428,8054374310139469044,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5164,i,10420959308635987174,9600563238758883252,524288 --field-trial-handle=2308,i,3483231892443040428,8054374310139469044,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5160,i,16202848713153398064,13735874705923242716,524288 --field-trial-handle=2308,i,3483231892443040428,8054374310139469044,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:14
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4876,i,2558048153210575197,2131185234395117570,524288 --field-trial-handle=2308,i,3483231892443040428,8054374310139469044,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5604,i,11646141056046413862,913333142424595645,524288 --field-trial-handle=2308,i,3483231892443040428,8054374310139469044,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5760,i,17335809222707925631,9354287243124643689,262144 --field-trial-handle=2308,i,3483231892443040428,8054374310139469044,262144 --variations-seed-version --mojo-platform-channel-handle=812 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5356,i,1367111895412310676,9834758876578269937,524288 --field-trial-handle=2308,i,3483231892443040428,8054374310139469044,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4828,i,18374541901195532951,13924115124593702291,524288 --field-trial-handle=2308,i,3483231892443040428,8054374310139469044,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6544,i,6203670426325533632,4853007509609808680,524288 --field-trial-handle=2308,i,3483231892443040428,8054374310139469044,262144 --variations-seed-version --mojo-platform-channel-handle=1096 /prefetch:14
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5760,i,18367454397490887891,16409780675669929019,524288 --field-trial-handle=2308,i,3483231892443040428,8054374310139469044,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5544,i,18094383099886724310,5035756917718771809,524288 --field-trial-handle=2308,i,3483231892443040428,8054374310139469044,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
  2⤵
  PID:1884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5000

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bea28d9638dac59990bdc6b9fece9f477f8d28c508c1a253fd1565bbc9fc4ae3
MD5 f10d65bdc736c03466ef52fb3e973cc6
SHA1 1553d68481be544f8fcd8f4f31978854061662fb
SHA512 1789433df7c4cb6b8c6af88635e9335389bfe36da7d8457f3b16e6d774ad9e050c045de056bbf16dcb7c5f7f882bdde6345ed9e7f12c4d6295e169346b1bbbf7
TLSH
T186D08015378CFC09C945303258515751F5255861645F8F445064D41DDC755D313570DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27eeefdbc28c4562b0f7961dbf8ecc36dc6cdfdb8dba90b92fab4f8d38495733
MD5 02240668b330773d82eb39ca82064ff3
SHA1 da6a7c95e21b04cb7aa5296fa464996f592a9476
SHA512 850ad2cbde9cda49998ffee162ecf4a7e854604619f29434682d460d4b33049219c253cb3208a75d43cda1a23a05ad280b0f98228e3cc9146d1a22b246e53b30
TLSH
T1E2D08011379CFC09C945303658515751F5155861145F8F445064D41DDC755D313570DF
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 b208a3fb0fb6025d6c12b71730fbcb9ac0dd0915e18144503ad87a288e49165e
MD5 e1789ede7ec71d87a4480e299245065f
SHA1 096a114d92aa605905670c9504516ed838e50dd8
SHA512 1f8b0f5e150ed5efc97ea1e8b84a05c312f8d31fef085e810f8caf663089378fe487c57202b7966a411e4ba5ca1a7f381c9ff04c1c256335145244c981dfb646
TLSH
T1ACE078D917C4C39DF307644B7354C70C45C0361FD6C47B495714845430410D467D3AF0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 266872883f8b90b48159005d16bbfb72c66ad69b5e08348f072a771e4f23ef45
MD5 421ec165d68d7fe305496b4eb1415f08
SHA1 d04b7eb10fccab872b48d31d914fceca68a3d355
SHA512 bdd57807cdcc0563555434e8a2b6cf56a39f197ede8166a49ab3773f3659591c2096ed6dc17f1f94404f24946c56dc700f66c3cb6d55e3ca871e6be341e2b302
TLSH
T1C0E0DF5C73A6C3E8A101E48BF26952148AD0F16597CC86FAB218AC95B64288A5BC38F4
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 276B
SHA256 bc40fe32ff83cdf9384b76b530a250d6026521bfa4f65dd197dff408074d75d9
MD5 87fd7b094830afce37f3f23cb0fb777f
SHA1 3fc1925a7b7468e0d74c06dc8804924d0c211f2c
SHA512 810658077fec7b278b971052494cfd213d53edc3d2e9e2c7bcc7481907278228e5a2ddfc1913f32c3daf3a0d60c297dd0f1e832b686a7d4f4e70d8f5de6710af
TLSH
T107D02BAEBD8C998FD7D11CFE8732F0000B9565A2D42FBB130224FDC43281BB01E29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 b3cebd03a85f942f20ce4c7203c02a18dedd1cb490566aa5c915f7c27e953c2c
MD5 f29ad0456d0b19e0b7c44e7d80ff7e5d
SHA1 80798b6b7053d07b5ce43d44c40d7e47c0fe7849
SHA512 b498c802ccc8a833a7dec3f5a80524da5171bc9ca082abcc037e62c5f8c56702dfc042991882810dc87230394da278a5d2b652eb0bf55ebb1d46244138fd7c8b
TLSH
T1A95194D16F21C5EECBBB443A51F3308975F083E28AAF7E1C618052B94C043094E955EF
MD5 SHA1 SHA512 TLSH

Submit Download

9f8c37ba-f800-4fc2-8581-321f97ffc471.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9f8c37ba-f800-4fc2-8581-321f97ffc471.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 9be535ed568a139bb3c90f462fbef0d4a24f7fb433d850ace4ade58aa039e9fe
MD5 e7ce002f545c1479c095bede5395d736
SHA1 9b4bab34582419ffe485f5978251561e29e5a31b
SHA512 32970eca102e80ec13686c191925853583297d9a92c4ba912c5d8db06a0d4c1379bba90aad32d822f011b393de61f0c64f385ff348a200ec7c79eae0acb1ce60
SSDEEP 1536:TfEEjWlttjpGZqW3ynPDuVLpBO6CvBcZs862UqPq:gLlEt2BmNUH
TLSH
T180B36227D6A64C6B01F16264EC754383F325436F9286A82F3A3C5D5C2FBD93A6502F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 63b01e83d484eacab066bad7c87b4d0ce3411448a9e870aed03e0c959710b059
MD5 e56fe85a5fac11a9dd7737842593b840
SHA1 68afd861bbfa4648205616b33763bd5e9df58f5f
SHA512 7facc81857d6bee3e253bc21faf8a893400e4f773046541692d8172b5a106ec79a80eaa45adafea95df5e082404be3209b9c36bad30583c98eba4914b237fe1b
TLSH
T1BC318EF7C7E8867D8A0145F4BB186E1BCE290915832C7D5AD8E49E1B93E2471E18099F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f78cb2ec912d4e9f8d49411809f19d83ec59cbdde25388fb6d67215b3d045db4
MD5 e36e1b6b2d5574b0d3bb1135dedd1e87
SHA1 c1a7f742fec3d8c025583c77b2d886eb750c188e
SHA512 c1b370ec20e184e5fdb2e4b2a8138abdba1c0f3e51855f783b42037a8fb01a1895b4f5d5c137de7b4320e2d2aed2117c05e9bd363a0c2eda1bdd00d15cd2a5a6
TLSH
T19741ADF7C7E8867DCA1141F4BA183E1BCE290915832C7D5A99E09E1BA3E2471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 dd577771dc33a372ee75f6737c9c74cd1ebe9b041fe107e56288935d606bb993
MD5 f87e6a06f21d4c8b853cbd7b7de52b8e
SHA1 8f4815b840c624e2975a7747cd047e1ee948d3fa
SHA512 79db4cd8d5603885d456b2c0f2092a3b938ce2c2e9f2ae9eb1bc3b2acc364f5bed27a4abde7601be0239764d9e472ec91db2585e3c2df2cf0b479cfed6d7b988
TLSH
T19C41C0F7C3E4857DCA0185F4BB182E1FCE290915832C7D5AD9E09E1BA3E2471E18099F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d87e89c2f8bba5297a4078b7542feca42d632f28b67a2e22b5aafab56d1617bc
MD5 e22853a3ce65c8111d0c42e2c631dfae
SHA1 16e10640c0a74c4a3cda774d08338708878e39b9
SHA512 ccd665bade520f619fd4d5f766aa1c955e217579811e61b1f002feaece94a5fb7902f056590e5d1f1a508d72ca0d122643748fc2c540c00ce44606266e4968f0
SSDEEP 192:sxRpg/ywF6KOMl8wFy/fUs8HiVWUozoA8p4M/g6+WNIYTKVdGeIgIJ:sxRubby/fUs8Cg+x/5IJHs
TLSH
T16B52EA155628597BCCDBD219FA56BF53D6F90533A2500E44EAFC8A0C05E76ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d0313b7314f6a46acca837c4a7dbf219973caf22a19f93f4a66be428c425e5cd
MD5 4fa2d6e28735daad9f6c9cb2f51d7be7
SHA1 53be20cbd963967b7a3069fb9d3e1f03c58f5c84
SHA512 b4648b9cdefd4fa1b836a4c5ed5cc7a646c180ba23528b44c8b9ef3dee5878ed63c3a180514897967bd45b1582b40bf39bfc8d622644fffb437591c84657cff3
SSDEEP 192:sxRp3/ywF6KOMl8UQIFy/fUsyHjVWUozoA8peM/g6+WNIYTCVdGeIgD4J:sxRdbq+y/fUsyDg+b/5IbHA
TLSH
T18362D9169628597BCCDBD219FA56BF53D2F90573A2500E44AAFCCB0C05E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8f493f662b45e9ccae7a823a5ab970bc06d6025a360c87787a3de44a2713926e
MD5 e47a7b1b36d43526fa830fb26cd7f5f1
SHA1 d4c22d0353dabf2a83d2dda197f7a600a3a0650c
SHA512 b96ed7cf32c9a6ac3c50353bd61c6faff2f5a3d7a4756fa84cfa7eb45ec90efd555dff08347d864970e91ef258ba89f78a8cbc938c2f3a8c55121dbe313c438b
SSDEEP 192:sxRp3/ywFXNKOMl8UQIFy/fUsyHjVWUozoA8peM/g6+WNIYTCVdGeIgD4J:sxRd8q+y/fUsyDg+b/5IbHA
TLSH
T12162C8169638597BCCDBD219FA55BF53D2F90533A2504E44AAFC8B0C05E76ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 28494f51db4db644de12de252094d6ad6b13f0c91b0dc31eabd594890ced40e1
MD5 f2ee3955abb3502acc68d82a86ab76ad
SHA1 07edd2fd86a82b15b101d204f1f38c28fa61c06d
SHA512 143d0f79397b253f1a209cb51b1a793dc9494292c760218553e1c4a530a32137660d35b9761e896190d952c0808eef2c0bd85801944d9ae827bb4d8b237163e9
SSDEEP 192:sxRp3/ywF6KOMl8wFy/fUsyHiVWUozoA8p4M/g6+WNIYTKVdGeIgDCJ:sxRdbby/fUsyCg+x/5IJHS
TLSH
T19F52E9169638597BCCDBD219FA56BF53D2F90533A2500E44AAFC8B0C05E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 625e592d64d7f672f764a39ce7bc7e7f9b19f1cb7608927bd33665bc1b117602
MD5 aa03e3dd6408e754f1267b32a3261a2a
SHA1 bc94e190a2be4e3dba701c8704aba27febe6be98
SHA512 baba162b421e6163adf3170b9035e8afffb20c9ea8b156b35058298ea45bc2d6a8139da3db1329ca6eb44604714978392f9a199dee5e91d730263461adbaed23
SSDEEP 768:RGqOYrWgTvfiX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJzFYMroK8T:RGqOYrWgTvfiXu1jaERYXKk
TLSH
T119C20A3F640CCB7E4F804AADEC25BE9A6DD801CB56984D5447EA894C03CA7FB511A4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a871af8b-b609-4793-a5b9-68e715e88401\index-dir\the-real-index
Size 216B
SHA256 e0479a949ef6dccb4870d81d019e5a965a29280383d6caf3eeddc1d70ae2d96c
MD5 b053848ada02de6053933fab9e8d40ed
SHA1 3d95be5e8b640fafe3d640a2c1b555f41bb62d07
SHA512 c9b82802d17b942cd393b9a397c2b0ce9980812ae7e8fce2d82be8daf331a359649eac3ec74787846e7def37afa1e84dcc8197db0b7dffbca6b84175763d2daf
TLSH
T10AD08CA86DC2079AEE01087484F3610C07A77AFFB8047B1320BC607988A362DA046288
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ddb30.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a871af8b-b609-4793-a5b9-68e715e88401\index-dir\the-real-index~RFe5ddb30.TMP
Size 216B
SHA256 adb49435683ba77bb83ac8a7b5773ec324b94542305c6eaf6b5a2d7332ca7c63
MD5 882ecff81903fa3eb39fa9d7a53e9728
SHA1 fa4645b401530465d51644bf24ac7142ba181706
SHA512 ae766afcd5c533d0d88190cd05543b556d36ac85a4125366bee523ddf23ee71af57aeaf29107f755cb664b5d1edb9410b185c2f4fb8d9a5818fbd9a7066fb2da
TLSH
T1ABD08C911BC01B92DE414D7168432A0C02A7AD79A4006B0330E4A0AF887255818466CD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 e4a899f1f499ceddd679cd9aa485f6c5b46555b465b0d5298367aeec89183924
MD5 31e3773768be50d756397eb9c8e0798e
SHA1 d11d36b19b86800eb82ba7a89161988c4ba7c177
SHA512 846888680cd671f6f23e9e7de8925691055784c3f2a257b5540fb0901ab8ca9e7bc0ec80865d203d734367a42894a044e00c067d78de2c224d3869b9baaf3e0a
TLSH
T119E020732DE75C04AC9FD3E2587255A1001174558554ED9F542D968730F139D780AC71
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 54fa8d9ad9de70c3ed472f4326489207fd28ad88fe361761abee19b5dd6f66f5
MD5 60df111363443fc7af62d08566618477
SHA1 bdbd90bd5d10faaccdefce04a55162c816fe24e3
SHA512 3ba7db0ec4f6fe63c82f7fe04b12b33107276ce37ffacf823d81c1c88b848d9469ba57aba9c23581299d8f8d6212663dc9c012a28988014d11d7961f03b31682
SSDEEP 96:K0usK7iGOFuK2Y66/masMs6WURJgK6K4PgQ6caS5oqzHRu/bpM:yLNV6/masMsFURaKCPgQBaS5oqzHRu/W
TLSH
T1F8915744717F3B8538BE341D9491C81E998236633429A4BB7BB855E20F2BE065EFCCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

0bd8c538-9786-4524-a238-5b17f2cd5ff3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0bd8c538-9786-4524-a238-5b17f2cd5ff3.tmp
Size 22KB
SHA256 e7dfcd2af3cefc7ce57f7bf6991d35a5d20958cb42766f953d9e1c76fae333b6
MD5 5cb2b7e81b4702abd9866dd283d10b96
SHA1 5384d524ca48437435a367dbbc158070ce70493b
SHA512 c5558f99f45f9b2e4cc7c7fd80211556401a16d808a8b34aaccf6cba23f5b5a5e834235a19cf251015bda0baa50c8bea1b0a20624e7e483f5a039e0d86134f85
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uQ:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAZ
TLSH
T168A2B81DC81C7E3257CA2F7D6A2F9DB276CA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a64d40c2cd026582b19a9ad5d58308363f5071a99b00d83b6288dd46f066730f
MD5 53de2b232436d65cd9976833feb861a7
SHA1 dd3e2b10e688a1dc9fa52b994430f2d5f475f933
SHA512 f4991618443b7e6b30fcdf1b8568da53604de8dc3d9f79f2b4952c1831b96bfe1fc56e3728b87a44730747e06839d1e3391911b2175f17fd7ae9933670badfd8
SSDEEP 768:7rv+4UNbdj3y6c568vX4hXodOiIyN8Y1M1fmBnZZRboS:7bsbF3yrhghXodI11ab
TLSH
T12103CF32EC6899739DF78288F15776037EF051938BC91B94D9D86B0E064B6EE230BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ca1592ff8798c09386d2591cd2c82e49e2e37e7e5193b654dbdf020a0951d44f
MD5 53f3e350c1e3628b79d296939b5692f6
SHA1 2aaa8f43f907313ef7becf46d067107e0d952d4d
SHA512 6c981ac788d356f904ea7be0aeb8d6aa5b855bef4e40c03d062392c32f1d3843717a53a0777902762ed805e4451be739fc8c5a542ccae5661241cee2217a9d2e
SSDEEP 768:Qj+9R3y6J68vX4hXodOiIyN8Y1M1fmBnZZb9Mb:v9R3y2ghXodI11ab+b
TLSH
T1A6F2C032DC618DB34DE28289F2573646AEF082A797C92F8499DCAB0E06876FD5307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 ea1ec7342b6c57bb0fa798212e054356fa869af791c8c42a20bca0599e2fffd1
MD5 a76e8b97a903ddfa5948e70e8289bfb1
SHA1 1f8aecaeec61493fe9d293e78b68119640d2313e
SHA512 df4262ad1dd84f8ec537c4c87879bcffc84307d30f84e72eeb4950277a1f001e49a93a3dadfea75dfd7b659eb583cd9bffcc5ef8c3bea12754289317f42a550c
SSDEEP 768:FF1j+9a3MwgU6J68vX42XodOiIyN8Y1M1fmBnZZb9Mb:M9a3H2g2XodI11ab+b
TLSH
T1B603BF33DC54C9BB9DF68789F6573206AEF041A7C6C96E849ADCAA0E02476EC4347C14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c54eb2a6ce57a83a24bd25d72e9a01e08195c40e52f2c2667c2af3e0aa9e20fd
MD5 cf3400d956c3646af788c1a2dd265c9b
SHA1 2eb568bd761a03756314e362f64f03e75faf8246
SHA512 8dc2f10c3ab02e8cdc17763700894609c9052cb00c49730a6e5dda980bfcba5bdd49aedd46397504d48c94ba7c3d3bbc484e0c7c37721c32e751bcaaa4ff7a15
SSDEEP 768:oj+9R3x6J68vX4hXodOiIyN8Y1M1fmBnZZb9Mb:39R3x2ghXodI11ab+b
TLSH
T112F2C032DC618DB34DE68289F2573646AEF082A797C92F8499DCAB0E06876FD5307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ea94d6a8ea1dc56d78c1ab8afdef5da59a8f7dad47a6f9467512428519f1bbe6
MD5 20ae6eda1fe9a5bfb9b6b55248df05f6
SHA1 ee10cac5f842199a3f3b87aa512deeb15a76c97e
SHA512 0bcb1aa663c43233f7da504211902b2035b88ee439cd5b8171eddd7a6f436a03fbfd8ae5616d6881534384b0b2fbb9a9483306015ad6496f06fd993b546464fa
SSDEEP 768:Yrv+4UNbdj3n6YOVXodOiIyN8Y1M1fmBnl3v0B:Ybsbl3n8XodI1148
TLSH
T18D03BF32E86499778CF39288F54766437EF451938BC50B94DADC6B0E4247AEE230B856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa6beced-857c-4540-9f5d-b261f8777a89.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\aa6beced-857c-4540-9f5d-b261f8777a89.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download