985618bbd2d441e0090e8a78e54a7f2406a79812fec01125593082edc1c194d5

Analysis

user interaction
yes
max time kernel
298s
max time network
289s
platform
windows10-2004_x64
resource
win10v2004-20260513-es
resource tags

arch:x64arch:x86image:win10v2004-20260513-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
09/07/2026, 06:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-2.html
Size 2KB
Sample260709-hlxtqaex2w
SHA256 985618bbd2d441e0090e8a78e54a7f2406a79812fec01125593082edc1c194d5
MD5 543438fbca0881bf23a3c5c3dcceb2de
SHA1 51cb8122f992034b002e7fab49dbcc6a4b180dae
SHA512 23d920605b90b1e712e1a753ceb214f02d55ea5fcf85ede56f68b8cd7e284c94d8bebc11fa984a1b98f862884b6da85a8abbcac3dc45b88a647cd563c132a5f3
TLSH
T11451EC63D758485B62E248ACF113F76A7AE08580A30F823539712F57ECCDC39D392398
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2468	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280534176505781"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{D8DA4999-7578-4510-B9B5-6583983F2344}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5308	msedge.exe
5308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2132	1288	msedge.exe	85
PID 1288 wrote to memory of 2468	1288	msedge.exe	86
PID 1288 wrote to memory of 4396	1288	msedge.exe	87
PID 1288 wrote to memory of 4396	1288	msedge.exe	87
PID 1288 wrote to memory of 4396	1288	msedge.exe	87
PID 1288 wrote to memory of 4604	1288	msedge.exe	89
PID 1288 wrote to memory of 4604	1288	msedge.exe	89
PID 1288 wrote to memory of 3916	1288	msedge.exe	90
PID 1288 wrote to memory of 4268	1288	msedge.exe	91
PID 1288 wrote to memory of 3916	1288	msedge.exe	90
PID 1288 wrote to memory of 3916	1288	msedge.exe	90
PID 1288 wrote to memory of 4268	1288	msedge.exe	91
PID 1288 wrote to memory of 4268	1288	msedge.exe	91
PID 1288 wrote to memory of 3336	1288	msedge.exe	92
PID 1288 wrote to memory of 3336	1288	msedge.exe	92
PID 1288 wrote to memory of 3336	1288	msedge.exe	92
PID 1288 wrote to memory of 3204	1288	msedge.exe	93
PID 1288 wrote to memory of 3204	1288	msedge.exe	93
PID 1288 wrote to memory of 3204	1288	msedge.exe	93
PID 1288 wrote to memory of 2176	1288	msedge.exe	98
PID 1288 wrote to memory of 2044	1288	msedge.exe	99
PID 1288 wrote to memory of 2176	1288	msedge.exe	98
PID 1288 wrote to memory of 2044	1288	msedge.exe	99
PID 1288 wrote to memory of 1144	1288	msedge.exe	101
PID 1288 wrote to memory of 4044	1288	msedge.exe	114
PID 1288 wrote to memory of 880	1288	msedge.exe	115
PID 1288 wrote to memory of 1816	1288	msedge.exe	116
PID 1288 wrote to memory of 3512	1288	msedge.exe	118
PID 1288 wrote to memory of 3512	1288	msedge.exe	118
PID 1288 wrote to memory of 3512	1288	msedge.exe	118
PID 1288 wrote to memory of 2596	1288	msedge.exe	119
PID 1288 wrote to memory of 2596	1288	msedge.exe	119
PID 1288 wrote to memory of 5100	1288	msedge.exe	120
PID 1288 wrote to memory of 5100	1288	msedge.exe	120
PID 1288 wrote to memory of 5100	1288	msedge.exe	120
PID 1288 wrote to memory of 5804	1288	msedge.exe	121
PID 1288 wrote to memory of 5804	1288	msedge.exe	121
PID 1288 wrote to memory of 5804	1288	msedge.exe	121
PID 1288 wrote to memory of 5940	1288	msedge.exe	122
PID 1288 wrote to memory of 5940	1288	msedge.exe	122
PID 1288 wrote to memory of 5308	1288	msedge.exe	123
PID 1288 wrote to memory of 5596	1288	msedge.exe	124
PID 1288 wrote to memory of 5596	1288	msedge.exe	124
PID 1288 wrote to memory of 5604	1288	msedge.exe	125
PID 1288 wrote to memory of 5604	1288	msedge.exe	125
PID 1288 wrote to memory of 5708	1288	msedge.exe	126
PID 1288 wrote to memory of 5708	1288	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffe0958c188,0x7ffe0958c194,0x7ffe0958c1a0
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,16046669471626416104,10301377943633160081,524288 --field-trial-handle=2380,i,17966854467603802898,7228239675074160437,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,2451615289081765273,5688043810474749649,262144 --field-trial-handle=2380,i,17966854467603802898,7228239675074160437,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,10522786266601567322,2141050164630066416,524288 --field-trial-handle=2380,i,17966854467603802898,7228239675074160437,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,2342678275164989111,5013815144089667515,2097152 --field-trial-handle=2380,i,17966854467603802898,7228239675074160437,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,7426367559588526715,15504348182029482061,2097152 --field-trial-handle=2380,i,17966854467603802898,7228239675074160437,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,15835641106235564995,15087639693680598394,2097152 --field-trial-handle=2380,i,17966854467603802898,7228239675074160437,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,7806480582862421003,40640004914318100,2097152 --field-trial-handle=2380,i,17966854467603802898,7228239675074160437,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,17866016645039250834,10334649646788769887,524288 --field-trial-handle=2380,i,17966854467603802898,7228239675074160437,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,3326299336497727659,4535507642044148586,524288 --field-trial-handle=2380,i,17966854467603802898,7228239675074160437,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,8232472925322437213,1100469333099268175,524288 --field-trial-handle=2380,i,17966854467603802898,7228239675074160437,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,8232472925322437213,1100469333099268175,524288 --field-trial-handle=2380,i,17966854467603802898,7228239675074160437,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,11775474107416458967,2584633844144576182,524288 --field-trial-handle=2380,i,17966854467603802898,7228239675074160437,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,11574370277288719131,6585752332637015043,524288 --field-trial-handle=2380,i,17966854467603802898,7228239675074160437,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,12860021477986481659,17101596025692829001,524288 --field-trial-handle=2380,i,17966854467603802898,7228239675074160437,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5368,i,159450131560742175,14450328184914044880,2097152 --field-trial-handle=2380,i,17966854467603802898,7228239675074160437,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,13533365378158483062,15740701661507780279,524288 --field-trial-handle=2380,i,17966854467603802898,7228239675074160437,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6272,i,14862149202750309529,16896047559429016413,2097152 --field-trial-handle=2380,i,17966854467603802898,7228239675074160437,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6444,i,791339538696026532,5339934958347541840,2097152 --field-trial-handle=2380,i,17966854467603802898,7228239675074160437,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,7737188819655716340,9531440244365909549,524288 --field-trial-handle=2380,i,17966854467603802898,7228239675074160437,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6124,i,4121112928422913438,764721196607691828,262144 --field-trial-handle=2380,i,17966854467603802898,7228239675074160437,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,2698828447467901339,408695051142323540,524288 --field-trial-handle=2380,i,17966854467603802898,7228239675074160437,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,10092416928178294365,1727362737056374668,524288 --field-trial-handle=2380,i,17966854467603802898,7228239675074160437,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,2172907524086219878,5192490289026164375,524288 --field-trial-handle=2380,i,17966854467603802898,7228239675074160437,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  PID:5708

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9aeab2c92c5f26a8ca39382cf1bb4652de05a24b8d0a9ed661920c6197bf4c98
MD5 722151c3c2c9d1bf9273dad578c24b92
SHA1 8c73ee2f65f9c7a61550c77f0ff7f3b2e262dbdd
SHA512 2d701005e69967e2b1d86e637b7e1011658167d340aa89a1d8a3826c1a0cd883f9a6d2e8ff8530362b27f034273eb9c1e432fc1a63348092e3fcfc9ecd12dada
TLSH
T19ED012323A18644AE656A1F0A413CB411637516624535B21B215949D9AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 46246483d08868ff03d5f9bb48e547ca61f651c3e59a4138f5a5da74c69b3ae0
MD5 c70fc44a424269679b1300a5be3376a5
SHA1 6162f1576d71e2726435c2e688415ae394c1369f
SHA512 c7fe73655fb22ef9d6d3620fa11cc8586300f67f906224e15b5de9802f495a10b66f3fdb475a44e7ed7af1a7d84be1c87f05f52d39641755f33237ede51a6e35
TLSH
T1F9D012323A58684AE656A1F0A412CB411637516624539B21B215949D8AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

0b5d96f9-4853-428a-9ae8-e9c584a03a9e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0b5d96f9-4853-428a-9ae8-e9c584a03a9e.tmp
Size 17KB
SHA256 d2eed6ab07f4cfc089f0ee7b8d49bb3c465e46a54a5cac683415387a2f3ff944
MD5 26418d9b1dcaff26c4554e2ff4ec1760
SHA1 6a45d3a2cfb603d25d1cc6ba685b3c5562a11a8a
SHA512 966328cc76edcba55aa0264c9c07b72d12c5b3e27134c9cf486cb08038fc33966775e20c593c41734deb61cdc3805568b7658e1fabe27f7117741aca16ad3088
SSDEEP 384:sxZlnWXsm1x/fUs7QwKtZbHbQ0/TBagDGFM:sNWcm1x/fTQwK7HbntalO
TLSH
T10982E7136524897B9CDBC619FD217F53E6F91432DA545E4CAAFCCA0C04EA6ED2203C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 571237e23d6aaec93271465fab2d44921facca70d32aa076b251aade4539c727
MD5 8d52d0c23d8dabc44fa4291715572259
SHA1 dc7814f349eb5fd36c225fe0da4accb5981c3fb6
SHA512 8038c7c9304c3e2cb90e170a1614d2a0de86a8c9ed470f1557e46a8b5ff081996a1e251ef671561ab3c0424d921cf14484268dcbe17d4a43b1b7ca2e2508f683
TLSH
T124E0209A49C5C21FD118A497435C5B4DD3C03A5F93C4ED1D27089ACD7501541E7C15F0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
Size 96KB
SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
MD5 76c1b9685c996f14f4cc8b585ddfb467
SHA1 e774b883f6b5736a9f0f0f05cfed247fdd8bdf6d
SHA512 d67c98951d327ea38ba3e761a229436782094e823847d989ddda919aa4de613bc7c5bb057968856414ecf2f2fe82e823bf3a04691d62ad7b67f7b6c142a807d1
SSDEEP 3072:rYsgcoaeqVBTILAbL7ABGMeTDm0ZSfKaXH:raU6qL7ABGMMmEFkH
TLSH
T1F7A3127B369F8CD14907CC51321A335688F4D0ADE2BA066B3D102E6A3B0B75F7A86F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
Size 67KB
SHA256 a18896ce72cc6b17475c314b4a0d2279510a397ea198f6f2688c678f77415ea1
MD5 29f180f7ee3d1ca5e9932ae816c89d5d
SHA1 f18d9cec562c5cef057de1f6d64d3f0e12ba44ba
SHA512 eee7ab576128172da6d6dbc1ab79a255ab7345e56a616ccb821f54bc7e67df41a600e431d84b2622553153dd618e9a69e047073926c5657bd2f0c5ada045e80d
SSDEEP 1536:lyzibffH+TaNoWprV9aU9U+wKUQ8x1bGIRNfjGGZD:IureTanrAU9U+wKUtxIktZD
TLSH
T1B06302F619561407D791EE157076F2992922A0ABFB29BAF3AD5A360605023FF3CC40B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 401KB
SHA256 6a5de4dc3214d4222924636215c5a493c04e939dad857cd0f637ffb2d610cc37
MD5 5d1aabca7ed21b4221ca924f3b607191
SHA1 d9d8fa6b53822206a6a81907c965c2981a8aae94
SHA512 91134059fae24d832b116a1c1d0348a6275959f25e89894144f443c30cc9e15c2b6da72355a37f02d9789dc31ffecf85ef7e376d4692772fc55d2f967b0c51d1
SSDEEP 12288:e+SS0aPiyjHu4kXEs5L75R4/+S3kvQZML4eVSEHn:TjR6QHu4kUGU/+hIZMMe9n
TLSH
T15894234847CE3176A1D6FB0B9AFB34036EC13649235F6500718F5A7927B03DCAA3A65E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 8KB
SHA256 17741efb7114883e1fb8b18dfe362b1d17bd8de280d296497c00ee0edbef7a2e
MD5 3ccaf8b562cb165093393ef85ea61bb2
SHA1 f108b1a65e336fbfa17343685f49e6d5495d12ce
SHA512 1334d6c76d519ed6abebfcf60683521ab2889a08d42152197007d6e98ee30b9454800ba67bc9f483343996ee68b34e6233907aabd310eca4822a616dd9386b02
SSDEEP 96:ozR+E6C8t7BAgL3MkV8vI2gXDEtIGS8HJmqCy8lpL65hN6fkYTGxHnX5O:S+DjdB1LEvv2G7HJmqozLGhDY0HnpO
TLSH
T14402B7D003916598DB94D1B218D219A57074B89E3BFB0F375492C3BBBA1F7DC21ABB18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e7c46abfcd2afaa66d9cb12c50613f020adad9018a35b8c398817e6ad3f1b86e
MD5 850cf7690399783a675f40193444c17e
SHA1 d45be48911585381671ca653d5719f32b90d5d89
SHA512 6a296730aa662471a4d0ffc25934e4a3ff887f0430634b6c24e7a9894c9771a6f4cceaee1f8e576b8da4c46da8e052a012712d83390f752698ed76b0437f14a5
TLSH
T169613CE502420861E3A512F2ADD232553571F09E3AE75E5781D2C6B7FF0E7E095E6E0C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58febe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58febe.TMP
Size 3KB
SHA256 5663f5fb1ff15ea213ca3fc5941144a3f99982c0509ec380d7d27ed7d0bf33fb
MD5 f4ea9aaa934fb0c1418df71b42c1aa40
SHA1 0b9cb6d70b760b84b20d11935b6894f920b0282d
SHA512 b9319fa05b5e29e948f3557e4124707b99919aa48b38401ca22bed68a8d11daa7f1ce67185c94b99c8985a0de73ea9a44ede88f812188f7a7baea61ee6489fc6
TLSH
T1E4613BE502420861E3A512F2ADD232593571F09E3AE75E5780E2C6B7FF0E7E095E6E0C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 9be535ed568a139bb3c90f462fbef0d4a24f7fb433d850ace4ade58aa039e9fe
MD5 e7ce002f545c1479c095bede5395d736
SHA1 9b4bab34582419ffe485f5978251561e29e5a31b
SHA512 32970eca102e80ec13686c191925853583297d9a92c4ba912c5d8db06a0d4c1379bba90aad32d822f011b393de61f0c64f385ff348a200ec7c79eae0acb1ce60
SSDEEP 1536:TfEEjWlttjpGZqW3ynPDuVLpBO6CvBcZs862UqPq:gLlEt2BmNUH
TLSH
T180B36227D6A64C6B01F16264EC754383F325436F9286A82F3A3C5D5C2FBD93A6502F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 668b9001059c3a5e6a8d263b5029b8dbce7d9cdd0cb4a8cb740af42d4c887903
MD5 f5cf1a9da86ffbf729045af66cb41b3c
SHA1 508a8a4a48d8c0415106ff5c19fb57d819f2543a
SHA512 a2795c485b679e1cdf91d45126d89994b0b34a03aee7c5764a4827aa9db2ccf194a5e0a66fb572280c129f8e365e3277446454733ca914cba6a9ae6a07e8d30f
TLSH
T1C071ABF783F5862DEA1195F09E186F1BCE1C045243AC3D5A85D4AF1BA3F24B1E051B9E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 6c169ed1e2ea3699a16d122ec0aa743146a9c9e8707c7ef684cc1a2e1c7bd199
MD5 174243e665b232252d166bc9314aadc4
SHA1 48cd597393244804f04a9d3d518b997eabcadda9
SHA512 c4bc43ad164b5ee73df55394366aae031afc3b8a78db1041aa61ae63be37da4771514824c41e5df5ba590acaedadf61194c69886aacbdd79cea734050144caec
SSDEEP 96:D66I6GRSmKwBj6VcGORtHzRBJ5/evtEBSi16x:D66I6GAzkj6Vc7RtTHJ5/evtg916x
TLSH
T13191A8F6C3E6462DDA1155F0AE186F1BCE1C045243AC394A89D4AF5BE3F24B1E052B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 680bc35ff6e92543263354d5f611ed24bdadf2c98bff8f7b544e4478f6d1ed4e
MD5 5c440ab7798c9f4cf80adf01148ee5f2
SHA1 c3c258c6a837d1ad4ccf2d98bd08abab72c24f73
SHA512 b4b4e62058a864f3c0f7d5c3c7b1287df2bc7bd9c7133bddb6c339f902032e4d3974338fe2ebee59791cdfcd0ccdfa8d38c861f02926a4e341a0285948b59b9d
TLSH
T16BD02263120AB0BAE56D3EED50AAAC8FCB2720640A43DDE460E0AAD9063146C55272A2
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe59c7ea.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe59c7ea.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c6ffd60794442e6ab8007be7dcb599664633b179e56b52fd661c73ca7e63a3cf
MD5 b36f8ff75d6f7e50bab284da404a4ad0
SHA1 dc079adcebf94d2dd74bdc2b577908b7422ed404
SHA512 a36b9b0e64c811e4f38b2bf2fbb53952d3a10e26548b59f415c6dd0c1d40f947254b06127bc770b420b26346a98818ff2edb565f3263f323a1eeabcd7db2d130
SSDEEP 192:sxZF/ywFaKOMl8Mkx/fUsJcs7wW3IupdjHW6+WNGY9IK3xkGIgrJ:sxZFXMx/fUsGwwGhHbGA9
TLSH
T13C42FA126A38997BCCCBD209FA557B53D6F50432E2541E48AAFCC60C04E6BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 85273540785c28f044a2d3f6501c8d282917b267b780a1b0fdacd1ba4ebeb56a
MD5 260830f07c61af41d72240f29188f6c2
SHA1 79e263ced43ca12cc65802b47224607553e3685d
SHA512 d655ba5103ebdb494967c0c73d703a2d39a92c6de59d66101433b0f3d7855597d5e95468d3683e39f98685306e7f935d70ef3e739cccf5d51eac9a79a46ce7f1
SSDEEP 384:sxZlnWXqJm1x/fUs7QwKtZbHbQjXhBagDGFM:sNW6Jm1x/fTQwK7HbgvalO
TLSH
T16C82F7136524897B9CDBC619FD217F53E6F91472DA545E4CAAFCCA0C04EA6ED2203C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 bc02433bd53647b3eeab35b70d88995cf751ec15d16549c9de9387e9eff7ceb8
MD5 2097f8b79e7e226d6e6e78eef3d00d79
SHA1 f34660b1586ce68f9f7dac0646cb2160cd2fc262
SHA512 1377ebc4867bd7b4ae2031eeb8f82343a62bf934b36ca33391a79414537a6f18e653313ec4da4a1998c3ab19955615ca5f23376b5ea8492f7421ae6545e085ae
SSDEEP 192:sxZNQUnx/ywFaKOMl8MWOx/fUskcsLwW4/uzZbPmjCupm/jHW6+WNBo8Uu/Y9Ijz:sxZlnxXuOx/fUs7Qw5uztwlgHbD/JBag
TLSH
T1AD621A03A624597BDDEBD219F9027B53E6F91532D6945E48EAFCCA0C04E67DD2203C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9f7112e43349a86eaf12fd0d0b4cc57b401e5ff4316c16b81d819ce0e641d8f7
MD5 d5dfd36a89193d4ad57ab663c2ee86d8
SHA1 719e4c47665b80aa846fad58e49514c7a661fb4d
SHA512 e223b6fba6d26f6b1aac2a7bcc9785c3d9b2385fd271d6e59ae465d2f6ea83813f459992dbfdee17c6685227aaf610ffd9ed9f192d1daed635d98231a240b945
SSDEEP 768:Efcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsFLlwmWN/ro8gfAV:Efcv21wWvu+Z+u1jahFLeRNs8L
TLSH
T1AAD20A2B280CCB7E4F841E9CED2A6F8A6DD801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48e26c41-d32c-4749-ab53-74e50cd5544c\index-dir\the-real-index
Size 2KB
SHA256 fff6f6184a0688011df5ebb7f2563e19e9b7e966faa0ddaae3fd0be8b76b94fc
MD5 dcfa2fb64fc8c2835adb9cc44c312b23
SHA1 80da1638ad770fd9f048721ddc97b7b237427269
SHA512 c9cefba082fef89281a3de0e5b6eecdfba80f4328c734210fd92f5b185662b760faeb12aa9c7188d07e80bd7322cd549e15799dc3a50ae21916dc77a84e95d03
TLSH
T18F51C78ECC895BCBDC7C61B368BA04C5377A14ED0688CE0B59EC6534BCC323C5956654
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48e26c41-d32c-4749-ab53-74e50cd5544c\index-dir\the-real-index
Size 1KB
SHA256 450e37b7783278cf97072f4b6b279c97cdb54823c4825bb3dfc7ef1d08de6289
MD5 34d988b850429a49575af8bd3646c1a4
SHA1 875d39d55341aca3f53aa1953e7959b32194a81f
SHA512 6728ec9c6d314f38ac1b7d67d9f25e0849720b4e0151abb8994e035c41e8a65743e27bbf5d47f12f8011e1069efca2c6e7311a406e214c357ca99cac8c713ee7
TLSH
T13931309D8E91CD5BF46041B615B6A4E8737088CD0B24A323887C33352E7335E2A8B4DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59599f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48e26c41-d32c-4749-ab53-74e50cd5544c\index-dir\the-real-index~RFe59599f.TMP
Size 1KB
SHA256 cad1463e02f8ae9cf939d3a747e2377f69123e608164fbe5bd74ba4619a01661
MD5 cd2fcec3b06146ba6edf9c1c2fb4c4e4
SHA1 d97e988231da825c483ce5123dc3275929bf8ca7
SHA512 c2b2c2d9cc58279de549be6fb128fe4ae1b493328755c5b0ab03681e1729ecbc4d1fea267150e5812f895dddf637597d1eb53bd3476e40723e8cb271c8c7a019
TLSH
T1F231328A4B918E0FF8D4517B0E63B8F8733588404322B393A87C62399D65B8D2E5F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5be853ad-91da-48fb-acd5-fe27a3692c19\index-dir\the-real-index
Size 72B
SHA256 a276748893bcdb5aa1a8531e13b63306a5c42dba48c8e5bbb73fb038f74b61bd
MD5 eac38eff5241a09107719306d802f356
SHA1 52436925e260e0f24ae6dec9b44420e19d5cf947
SHA512 9f438662c478682c67b44bcaa3b1a015df235f813c15dd0bedfd08000096d0a3b7ea8ac03e5251c8859f71e456e013da7d7df2daf181141c2f3b847eda307ac2
TLSH
T1C0A0021315CC9301E0244B7050A9CDC4729899115237131D74D04198CCA05C9A6061C5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5be853ad-91da-48fb-acd5-fe27a3692c19\index-dir\the-real-index
Size 72B
SHA256 12e7731dca14721f7a3aa27e42369dba4775f7a1973c83503b481333a4b9d10d
MD5 de60eed94ec4e5cc4b42910e6f2d4b45
SHA1 797a8e6913b366ec4e618013187d50aaeb4d0c8c
SHA512 7cac8cea271856d55d1b2a0d7be8990e98de4e73a39aa5224ebffd0e53eb3323fbecc65f7be07d2d079a170a148885bc72c56bf5414895f785a46df8f6141611
TLSH
T1FBA0025193A40000CB55017054621681131EDB103062875770D480A4DEE74C89D05084
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 d4f762afdf6c761e3526ed0dc1a901fcb457c6900123ef069e8f5e687bdf47f7
MD5 fadd108809d9bb734ad71446c03d32fe
SHA1 0c8cc524dd928ea6dd1d03dcaf4a2a3740a7b5bb
SHA512 701f8acbbb4e7a9796306b0e25b8b244da56721f2caf8da99bc1962ae7eb49e7c01b72e991cfc4278b0f69386ec738dd24719f3b7996e5a4e290a4271bcebc8b
TLSH
T121E0C0FA1EFB2C04DDAFC3D6083240A401433C44C944FC0F102A91C76070720340EC11
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 70d4d1a9614428a3dda6fd781c9c83359a6aae7bda1e79acb0b2bd22c077d54f
MD5 fe432fdcd3aab6f058c98565af8a5ae3
SHA1 ed8cac9bab35ed7328ddce245630af08589d17f1
SHA512 cd9d29f873dbac428a327ad9f0a3668c700c4737831ed487bf587c6afa036beef5d4c606663dd9ec720e54b68cb836369da6dd49be3c459a995f34b588fe768a
TLSH
T162A00251AE9A942AD51046F410A5715037D049D9071D531164AD91DC8DE1254E1C23A6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59aed4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59aed4.TMP
Size 48B
SHA256 2860251c16bf9bc7349fd09332dd9915a9b88a2733a66c534471bcb788688bfb
MD5 6ef7bc0d86ee8d9cff1fc6eb2daed426
SHA1 5f49c1fef202622a2414c659344412fa27cc62ab
SHA512 9fcb4906190fa46ce3987aa54a01baecd956a0bc1ef3ea347c96c0cab096ffc3d30267fac0e60581d71a532ec08f943d077a91d1fcff471692ec33b8882a4b2b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8d231dc414231993aee3c9842881781a5e7a7be010b2379d99b82c0f5f9aa669
MD5 b75ba616ed504efaf137313cfc7146fd
SHA1 b7fca5411cf2c85bb4f80a19e624b8e15c33ee4c
SHA512 28d0cd392c9b83417b6f0fe78c456fdcd58875ae675d5df3002955fc5c4f3152556d53361e950103305c47dec0417c271d395c97cd93d9c3a9a88afeef5158e9
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDOHuKw4OWvqKwccbEBVj5+:mTVlp3bEBVj5+
TLSH
T186910D06713A0257393D694DA7968B368F423163B418B4BF7BB804A24E67E125DFCCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 e7dfcd2af3cefc7ce57f7bf6991d35a5d20958cb42766f953d9e1c76fae333b6
MD5 5cb2b7e81b4702abd9866dd283d10b96
SHA1 5384d524ca48437435a367dbbc158070ce70493b
SHA512 c5558f99f45f9b2e4cc7c7fd80211556401a16d808a8b34aaccf6cba23f5b5a5e834235a19cf251015bda0baa50c8bea1b0a20624e7e483f5a039e0d86134f85
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uQ:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAZ
TLSH
T168A2B81DC81C7E3257CA2F7D6A2F9DB276CA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5998bc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5998bc.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 39b10958a53460f32cf1fa1e96affa3d0694ccbb231129e1827a865c751c829a
MD5 ab84309b09d3976b734ee5a0c616bb12
SHA1 07b2a168eb55e4f13a13f03aca159e9a11b359cc
SHA512 e5f5775962b0e3105266f90238583fc747885064e583acca149b29c7556abbe4777b95fe120a95b57e8cd9d8bba5d1f15bd27fc2d0e4404c678a91063877fbe5
SSDEEP 384:mtNn/s3n9SfsNkZzziK1Pe+CnDO85cS+pZdOObjI9G6w7ui:mj+9U5F2fDOQvIZd29Mui
TLSH
T110929D32AD394C729EA28695F54B3A178FB81177D3813F84E1DC6F0C06DB6EC530681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 bb4ab5deab56d4c95b946f90a03c5ab444e378f1b67299b112712ac90f78a3db
MD5 6559a9fac0ffa292b9b8583182f1a485
SHA1 21f6d10c9c4f5c1fa4f9e2de41fb5637f4fe0337
SHA512 c5e5918539bdcc2a054cfc631ee0bf927df7ac6bce94053b705880c997d613454f8692bea7afccc2c6b85c1bc157aaf4e830ee5c653e37f5df7d19884ec5007b
SSDEEP 384:367F1tNn/s3n9SszsNs8TUNTUlIlNTozilZQ2e+CnDO85cS+cBdOObjI9G6w7ui:6F1j+9ztwgIUQBfDOQvzBd29Mui
TLSH
T127A26C339D688D7BAEA68A95F54B3617CFB91077C6817E90E2D8AF0C01DB2DC5306C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5525bc84baecad64eb3b8152aa7c2f3a84b51b95182e8e5a5325546c8725fe13
MD5 04f8e0ca09ed716d4e6338f6e43bbf9b
SHA1 95ff94c232f67860eef542ace9488225c13dd669
SHA512 a3ed0d1457018233d56cfb4f5409c367d546513eae403feea78d680eafa1a309cd8f7868add3c49537b6f904f7a8e7533505cea18aad6f6569d388a3d069181b
SSDEEP 192:JONBB6v+YLNQmiUyyrZh+CGEDO89e/usAWvU6:JONBB6vz/vZh+CnDO8mpU6
TLSH
T19002E835BD781CBB9FB2AE49F58736135EA9113BE5912F80D9E81F0C01D769C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 600e624b1ea9c74d9b5ee6cc27ea8d00875176929277fb6442bc10e8109fb34f
MD5 e3772e6b6ee3b2fa3ee254ed51a68c91
SHA1 a7330390361ef25269a86b98aad0caac2d2685cf
SHA512 893c0f961a81b5fb0eeeb154df85f2f444d84f1f739a5288676a39e3ab15c3c1b9fcf7e589d775e2160fd29e44b9f0ee1ef87ebfa204d6c751a6f7db85511790
SSDEEP 192:WONN6v+YLsQmiUyRrNh+CGEDO89emYFS+/CH1qglU6:WONN6vzIyNh+CnDO85cS+UdU6
TLSH
T1DD120936AD384C7B6EE2A685F48735139EA95137EA853F80D5DC2F0C05DF69C234AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 44407ba88222925b5ddd2db42813fae43509e4de3ad53016c286e29f23c5ea23
MD5 394274ff790349721efd3aa5f46d0519
SHA1 c5c2b40b766661578528cc1498af50d6f46db183
SHA512 20da7485621c1fe62c2012829858583eb62f8fe0daf7c14c6e4e806823f85dc25aeb9405aca13593595cb8ff217092d104f76348554e1e7af0849d2c22b856da
SSDEEP 384:gtNn/s3n9SfsNk8zziK1Pe+CnDO85cS+pZdOObjI9G6w7ui:gj+9UsF2fDOQvIZd29Mui
TLSH
T11E929E32AD294C729EA29695F54B39179FB81037D3853F80E1DC6F0C06DB6EC5306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d6c55874c5614fe250883f03779459744bb3f4d1f0bbab5401065cf8c2f7dcbd
MD5 2679d9de611b4680fc23017c2de6b91d
SHA1 08a2408f40f74c1734d52f03b6f0e84993834622
SHA512 b77b29877a9d145309c2ceaed82363656fc6d63e36fc621b8471fbbb66eeabce07bda06d30cb93a4a2abb8f7a423830deb9369c83a663f3ccf46a3a3af3b19bf
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5993ba.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5993ba.TMP
Size 392B
SHA256 b96c82d76698e28cf8f26d87bb52134e219adfdb94887a5c5db58378ad3926af
MD5 18c3995b5386a666a865a088dffa4beb
SHA1 84100755e7b0ff7dfef926fc4b697dfafe9efedf
SHA512 0976a6309c2709ac539844d2c9940f500f527856479fa6d8fc42db276950f1703e13fdd4c94359c605093c9a9c6e76f0cd1f85b6df0bb86ba3b338e70518cf76
MD5 SHA1 SHA512

Submit Download

ff1c42a2-a217-416a-bce4-021d0448da4d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ff1c42a2-a217-416a-bce4-021d0448da4d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7e997b63e203a515ad414f2b8137ea9f34e0a8d93abdb2b46cb3c17ec7b269f8
MD5 6d1e9352efe39893c24fff388ae31dfb
SHA1 c913c1002f6718e5c64c3650cc3578d0fe0fc542
SHA512 2aa51bff8ea50b5d6d4c71187cffe5a3dec9f0fe1d81a08d9e78cfba6483180b12513d3296f68e1565112fa1948cd8030dccc03b8e473511a3d0664e5be4d49a
TLSH
T113412A5DAAF91108F3B36E5A9BF6A86E487FBC772E0AD05D10110D4E0A26F00DD61B33
MD5 SHA1 SHA512 TLSH

Submit Download