hxxps://events[.]zoom[.]us/es/AlktwbnRC7dwX6Wto4cyonZ4_xUtFTOKK9xRXQBTeXJVHoRSb5Ue~Am0d8F7UemQiBawdZYb7D99xLLaQEAcqROuMQu_ta457XqKdTCAXGBWdP4Hs8g

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://events.zoom.us/es/AlktwbnRC7dwX6Wto4cyonZ4_xUtFTOKK9xRXQBTeXJVHoRSb5Ue~Am0d8F7UemQiBawdZYb7D99xLLaQEAcqROuMQu_ta457XqKdTCAXGBWdP4Hs8g
Sample260708-mtltmsfv3l

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4708	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279811363891348"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{4CA022E2-C7E9-4123-8EFC-8C7145613A13}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 700 wrote to memory of 4892	700	msedge.exe	83
PID 700 wrote to memory of 4708	700	msedge.exe	84
PID 700 wrote to memory of 4684	700	msedge.exe	85
PID 700 wrote to memory of 4684	700	msedge.exe	85
PID 700 wrote to memory of 4684	700	msedge.exe	85
PID 700 wrote to memory of 4952	700	msedge.exe	86
PID 700 wrote to memory of 4952	700	msedge.exe	86
PID 700 wrote to memory of 2800	700	msedge.exe	88
PID 700 wrote to memory of 4600	700	msedge.exe	89
PID 700 wrote to memory of 2800	700	msedge.exe	88
PID 700 wrote to memory of 2800	700	msedge.exe	88
PID 700 wrote to memory of 4600	700	msedge.exe	89
PID 700 wrote to memory of 4600	700	msedge.exe	89
PID 700 wrote to memory of 3108	700	msedge.exe	90
PID 700 wrote to memory of 2728	700	msedge.exe	91
PID 700 wrote to memory of 3108	700	msedge.exe	90
PID 700 wrote to memory of 3108	700	msedge.exe	90
PID 700 wrote to memory of 2728	700	msedge.exe	91
PID 700 wrote to memory of 2728	700	msedge.exe	91
PID 700 wrote to memory of 2868	700	msedge.exe	95
PID 700 wrote to memory of 3968	700	msedge.exe	96
PID 700 wrote to memory of 2868	700	msedge.exe	95
PID 700 wrote to memory of 3968	700	msedge.exe	96
PID 700 wrote to memory of 3252	700	msedge.exe	101
PID 700 wrote to memory of 5708	700	msedge.exe	115
PID 700 wrote to memory of 5716	700	msedge.exe	116
PID 700 wrote to memory of 5724	700	msedge.exe	117
PID 700 wrote to memory of 3436	700	msedge.exe	120
PID 700 wrote to memory of 3436	700	msedge.exe	120
PID 700 wrote to memory of 4416	700	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://events.zoom.us/es/AlktwbnRC7dwX6Wto4cyonZ4_xUtFTOKK9xRXQBTeXJVHoRSb5Ue~Am0d8F7UemQiBawdZYb7D99xLLaQEAcqROuMQu_ta457XqKdTCAXGBWdP4Hs8g
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe71f3c188,0x7ffe71f3c194,0x7ffe71f3c1a0
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,29231154863540963,9915930533494786228,524288 --field-trial-handle=2088,i,3351404085366175473,16072409290966570746,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,2842107389173728867,16569766278038346317,262144 --field-trial-handle=2088,i,3351404085366175473,16072409290966570746,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1376,i,8138337573858112522,765656592593715181,524288 --field-trial-handle=2088,i,3351404085366175473,16072409290966570746,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,14140468111819405125,14639093729155765370,2097152 --field-trial-handle=2088,i,3351404085366175473,16072409290966570746,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,969688183865042652,8188243117158237699,2097152 --field-trial-handle=2088,i,3351404085366175473,16072409290966570746,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,4395844488592698994,3147372498236595608,2097152 --field-trial-handle=2088,i,3351404085366175473,16072409290966570746,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,11331869458992418632,2992749173177244457,2097152 --field-trial-handle=2088,i,3351404085366175473,16072409290966570746,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,9273665672152260300,8474650240162164373,524288 --field-trial-handle=2088,i,3351404085366175473,16072409290966570746,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,15254806320543454734,2636957197611906860,524288 --field-trial-handle=2088,i,3351404085366175473,16072409290966570746,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,17485634456686737454,10896392295959096502,524288 --field-trial-handle=2088,i,3351404085366175473,16072409290966570746,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,17485634456686737454,10896392295959096502,524288 --field-trial-handle=2088,i,3351404085366175473,16072409290966570746,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,16631517481911815581,2482140138460797800,524288 --field-trial-handle=2088,i,3351404085366175473,16072409290966570746,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,7804726387827006803,2411211523389711615,524288 --field-trial-handle=2088,i,3351404085366175473,16072409290966570746,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,6194015153082786996,14332766733284849226,524288 --field-trial-handle=2088,i,3351404085366175473,16072409290966570746,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,9809515875098890444,9969848070343399158,524288 --field-trial-handle=2088,i,3351404085366175473,16072409290966570746,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6116,i,289467789392733675,5064333060016630949,262144 --field-trial-handle=2088,i,3351404085366175473,16072409290966570746,262144 --variations-seed-version --mojo-platform-channel-handle=780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4416

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 83e8be22beac848d2d8034df05135c18bec9bca087e1fc2d57c012e8f79522f0
MD5 146f815600bd012730b970c55f6caf96
SHA1 61d72e5a14c659040cbff03dbcecf13f1509a907
SHA512 f99ef9b436b09b05aeb7428ec2e81892372775f9e95ffcf7a3dd191470aa29abe5f7c8365d9786ffba21fc5ef31c40298f05623314a563e42d2028d8e387d4c2
SSDEEP 48:CCbtU3WMG1mlv1hyi1sGA9szh2iNcV+/lvhrqt7q0LIW3fNJ:UA8lj1nA9+2iNcV+/4LIW3n
TLSH
T15991A4FB1AEB0E95EB21F2305AD10282B13081EBFA97EE235D84D3FB1C12335484A456
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58846d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58846d.TMP
Size 3KB
SHA256 ba550e84e83bb5848224ff6c2382282b2e5356251fa29df8dcb195bbda4cc2ac
MD5 11df0d4a0378d17282d18c634f7594b2
SHA1 c707df3be802f824fdbbb6d30e0d9725cd1e5260
SHA512 a25ab94e6f62053ee97059541abc5e6295f4f9daa26bfe7c7d2836e152b8b25b8b2fe36f76e1b8d5a4f52f83f317f470f56dc08331c8cccc64e26d4a2ca31543
TLSH
T102716DFE18E30FA5EB22F2705AC10246B13081EBF613ED238D80C7FB6D12731899A158
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 b418f7c78fc2b9aede9243e643f6f83082d809ab7fd118fc7ed822b839c57604
MD5 d96c58ab20a731ce2cdc00ee7699831f
SHA1 c8a75fbc67ca642dd10a1a1d2a3542fb07bc7838
SHA512 3770c8f874f6100d8305b69efa6109c6638021c1efd4c61fc4fdd750fd8ac1d69d5ad219aad46e7c41f71feae495abf2c61e7b9aa8382ca39f1b26212dbd7bf6
TLSH
T1EC81EEF3C7E482ADDA1251F4AA146E1BCE4D092653283D1EC9E4BF1BA7F2475E21190E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e75c3d4d9d4554911abc969b30922cd10695dd43e7c01eaf957a1b5f8a5b0d4e
MD5 6b5686fe6df44c83f3e070b004384d36
SHA1 585ddfb427c08798917a00a724316763f278afcb
SHA512 5aa7274a47408a3f355109fbd77b65f5e7c2687dcb21828a8daafc98c36e41a937ab95bec36f79009aef61f6edc31972a157cae404d40ed345a630ca673f7100
SSDEEP 192:sxZHRKyM/jK1Ml8Mkj/f1sN3h7IdpYwHW6+WNnhGu/YIRGEn+WIgrJ:sxZHAMj/f1sNxkhHbh7/z//9
TLSH
T12742D7126A345977CCDBD209FA55BB53D6F90472A2900E48EAFCCA0C05E7AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 42ebb23eb22b13cbecada87b83f943d8d241253b4701a7ad9a27e58778997bb8
MD5 c9c7cbf19539effc0578ed2b2533c271
SHA1 5ba78a351650eef2e714558154ac4f2e74a05a74
SHA512 35bca957040a165e5ab3565815888fec37546406d429633959955a58dad18cce03a31a877a98aa709aa438b899f6016021cbb06380a62c7b7f4aed36776924ee
SSDEEP 192:sxZHRKyM/jK1Ml8UQ0kj/f1sS377IdpawHW6+WNn+kXYIqvn+WIg59J:sxZHAqPj/f1sSLkrHbJXQ/F
TLSH
T19652D7126A345977CCDBD209FA45BF53D6F9147292A00E48AAFCCA0C05E7AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6f5741fc9bde323cbb2f09a405cc49d42a75bdf56500ee1e42248304de8d3fb8
MD5 fb847a4e903ec72cbabf26133d7687ec
SHA1 d9b13d40a3c9f98ce21c8c15a0828f695d9162a3
SHA512 6ec62073a627676c5ef9341fa9403fe223e4ac1025b7c6bccbcba71b52872dfe34cdcdb83e45d799c1c7fdb40d948e8e73bbd2893320bade4a1d94b55fe1bcf6
SSDEEP 768:i0sqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR99ro70V:i0sqxXlWvJD6Tu1ja54LAs927w
TLSH
T141D21B3B694CC77E4F840E5CEC26AFD76ED801CB66988D5447FA890C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4baa467d409bf338bd2e4e5bdfe926ed796756dd51ee66f6d87feee655f899c8
MD5 3ffc8cb6279638664aa9dabc54cb67d9
SHA1 d35cda5c8a34c0758a96a29884acb1e4bd8d8f6c
SHA512 05d41e3d323e83e88a2812b56d8214ecaa0012dfea51b6fd77010bebd184ba0487399518e3c6e7d8ff280df2b38531d305ada8f4b22b2c0b9b470074e1c08730
SSDEEP 384:KF1tNn/s3n9SrzsNO8TUNTUlIlGe9bkw6vVRN3OKZ9Qk5ScjmwXX:KF1j+9wfwgsdH3Om9h51j7X
TLSH
T1B2C207F259D74876DAAE9747A73E2E168EBCC067B5802A40F7885A0CCDC61BFC306D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b185ad40edaf465bf305a36cda9da0015583a3b21d19b54c9a0373f7d166683a
MD5 7c49fe65fb511e5c7e0e462d243bf748
SHA1 ab077a3bfcbd8bd44e3021ac04d831d7dba1e331
SHA512 2c9b356695358740335a9ff99265e066b0508585f53bf766401b768ac9ded1eeece93076f8ce8b9344e3245dde83c4ac45ba7792734c22bb0604ae95fdf96e56
SSDEEP 192:tONK6JkRtQmiUyyeW+RN3OmNOmFHh32ROFU6:tONK6UrkW+RN3OKBpDU6
TLSH
T12502E9357D381C778EF2AD49B98B27175FA8206BE9952F84DAD81B0C01D769C2347C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6c2515dac3193b9be0b565d1824bf9b79ef189a943f9cf92a8228f43468bbb86
MD5 e1f9f2b43e937fd9f60b6c1da75f9d33
SHA1 7ad44f12062460541323a425ca21a7e5f303d10c
SHA512 10091a21d9712762d0dca3d1a436838efd934dcd106ac78bd973f95b0b62c63834a0cbd3231f3c0774da29aee562df202f72875d5c845d3490bd2f871988a569
SSDEEP 384:ztNn/s3n9SfsNdUGe9bk3vVRN3OKZ9QR5ScjmwXX:zj+9UKdH3Om9y51j7X
TLSH
T140928D326D385C675EE2948AF90B36178FB8516786C52F84C9DC6F0D02DB6EC1317D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 fa3f44a5c327636417ecfe04b52608905f1d2c763e3eaa2464b0333b1f91485b
MD5 9c9e0f790cdf29b3aabbf294d5c3a0f7
SHA1 1c534ccff1d992b0bc682b5df7cf5c2076bc1b42
SHA512 e5a7ba130cad0abe6f9ffa43cc00701fb69003e2e816af1e49d33792468c265a601aad7dba71c65dd8bee71a94bb84441f9e35fc506dcff83ca164f6ab9350e9
SSDEEP 384:RtNn/s3n9SfsNdUTe9bk3vVRN3OKZ9QR5ScjmwXX:Rj+9U5dH3Om9y51j7X
TLSH
T131928D326D385C675EE2958AF90B36178FB851A386C52F84C9DC6F0C02DB6EC131BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fc99d8f11df0978d08b67b0689281aebabe406ecd26319a41eb3bc459f4d494c
MD5 1ac81fbedca9d1da04b59214ed2c3d66
SHA1 a088c93aff820a5335667ccbcbc83469e36bc90c
SHA512 fd6f93b08fcb0e628c33674af0e6f72f2e78155ab1192c870f2b31aca130dbd38c8e430774abd03fe2c9f1c9a97a9e49eecfbef2d621599963c71233bf786a43
SSDEEP 192:9ONv6JkRyQmiUyEet+RN3OmNOmSC9QjMcVc9qQTU6:9ONv6Uuot+RN3OKZ9Q05U6
TLSH
T1FD1209326C385C775EE3A845F58736175FA85127EA896F84D5DC2F1C02DBA9C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1ea6c7a-e1f1-4b09-adc6-bdb03f36dcc7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b1ea6c7a-e1f1-4b09-adc6-bdb03f36dcc7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ac86bceae4fa79f255f86396ed24170ccfc39bab0e55d52c32050a6610a6dd27
MD5 256e73e6476be6c0ba496320185b2b90
SHA1 41cb68c85f8ca962aced7c156207045028c62fc1
SHA512 d87d11113a61391166ff0778d79a30562ceca0afcf26a9f0462b393fdd291284799d975c997545cc013207feee72daad0d806b094b402c124d0c064761208e8c
TLSH
T184412A9DA6FA1148B3B76E569BF7A86E44BEB8332E0AD45D10010E4F0662F40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download