11be87d5eaebb8e73ab8e96296b05052735f1a522dd98365fdc08dd71967e63d

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CEGIC/pages/consejos-regionales.html
Size 10KB
Sample260727-aghj8sshpe
SHA256 11be87d5eaebb8e73ab8e96296b05052735f1a522dd98365fdc08dd71967e63d
MD5 717cd0a2a5723b844596c62b6094991e
SHA1 83f3d27a36830bd7ea926f851b7a153c9afcfe44
SHA512 0750b33a7cb9fbd8b27deb86ba4d5f4831cbb9e73519dc53856cd012b937640da1eef50dfef3910a260a2b3c26331b229adfa2af1c3a6b7e16cc559df4481879
SSDEEP 96:z9KzO15w4hstqm+lis+6+EiEvrG6VuwHAIJGvyMFHdeXv7H7n7m7m:z9AW5w4hstqm+lViETywHAnvVFHwXt
TLSH
T199221F166AC410A703A7778D2D85EB2E38F3459FDB2F8A01327D5A8E9F82F44991315F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3512	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134295846679544682"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{556804E2-B64D-4468-8868-9FD848F67847}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2412	msedge.exe
2412	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 3352	4476	msedge.exe	85
PID 4476 wrote to memory of 3512	4476	msedge.exe	86
PID 4476 wrote to memory of 2572	4476	msedge.exe	87
PID 4476 wrote to memory of 2572	4476	msedge.exe	87
PID 4476 wrote to memory of 2572	4476	msedge.exe	87
PID 4476 wrote to memory of 4596	4476	msedge.exe	88
PID 4476 wrote to memory of 4596	4476	msedge.exe	88
PID 4476 wrote to memory of 2580	4476	msedge.exe	89
PID 4476 wrote to memory of 520	4476	msedge.exe	90
PID 4476 wrote to memory of 2580	4476	msedge.exe	89
PID 4476 wrote to memory of 2580	4476	msedge.exe	89
PID 4476 wrote to memory of 520	4476	msedge.exe	90
PID 4476 wrote to memory of 520	4476	msedge.exe	90
PID 4476 wrote to memory of 2524	4476	msedge.exe	92
PID 4476 wrote to memory of 2412	4476	msedge.exe	93
PID 4476 wrote to memory of 2524	4476	msedge.exe	92
PID 4476 wrote to memory of 2524	4476	msedge.exe	92
PID 4476 wrote to memory of 2412	4476	msedge.exe	93
PID 4476 wrote to memory of 2412	4476	msedge.exe	93
PID 4476 wrote to memory of 5008	4476	msedge.exe	97
PID 4476 wrote to memory of 5008	4476	msedge.exe	97
PID 4476 wrote to memory of 2404	4476	msedge.exe	98
PID 4476 wrote to memory of 2404	4476	msedge.exe	98
PID 4476 wrote to memory of 3680	4476	msedge.exe	100
PID 4476 wrote to memory of 1724	4476	msedge.exe	109
PID 4476 wrote to memory of 4084	4476	msedge.exe	110
PID 4476 wrote to memory of 1736	4476	msedge.exe	111
PID 4476 wrote to memory of 2668	4476	msedge.exe	112
PID 4476 wrote to memory of 2668	4476	msedge.exe	112
PID 4476 wrote to memory of 4244	4476	msedge.exe	113
PID 4476 wrote to memory of 4244	4476	msedge.exe	113
PID 4476 wrote to memory of 4976	4476	msedge.exe	114
PID 4476 wrote to memory of 4976	4476	msedge.exe	114
PID 4476 wrote to memory of 1180	4476	msedge.exe	115
PID 4476 wrote to memory of 1180	4476	msedge.exe	115
PID 4476 wrote to memory of 2412	4476	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\CEGIC\pages\consejos-regionales.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffe590ec188,0x7ffe590ec194,0x7ffe590ec1a0
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,877136129320912161,15203258045066219766,524288 --field-trial-handle=2284,i,11831266629941819596,1688594267761840390,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,3703468006835390251,16689867939498882969,262144 --field-trial-handle=2284,i,11831266629941819596,1688594267761840390,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,7783164637963339735,7831630243147746605,524288 --field-trial-handle=2284,i,11831266629941819596,1688594267761840390,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,9775772908966414957,8304134826013206189,2097152 --field-trial-handle=2284,i,11831266629941819596,1688594267761840390,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,13836981350890900921,3963941254559676864,2097152 --field-trial-handle=2284,i,11831266629941819596,1688594267761840390,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,11789690091522874791,10496119873522027060,2097152 --field-trial-handle=2284,i,11831266629941819596,1688594267761840390,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,7184799263971084302,12262431569061016705,2097152 --field-trial-handle=2284,i,11831266629941819596,1688594267761840390,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,8585470356565675920,16326882832031446136,524288 --field-trial-handle=2284,i,11831266629941819596,1688594267761840390,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,9223829805460414429,153552695709367223,524288 --field-trial-handle=2284,i,11831266629941819596,1688594267761840390,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,7122680891649764326,16695309940812553591,524288 --field-trial-handle=2284,i,11831266629941819596,1688594267761840390,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,7122680891649764326,16695309940812553591,524288 --field-trial-handle=2284,i,11831266629941819596,1688594267761840390,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,4502488270615831481,14279000335834885824,524288 --field-trial-handle=2284,i,11831266629941819596,1688594267761840390,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,5866210301393440249,565453696059342083,524288 --field-trial-handle=2284,i,11831266629941819596,1688594267761840390,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,18369618116238536807,5011506192400218078,524288 --field-trial-handle=2284,i,11831266629941819596,1688594267761840390,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2980,i,7432364103193152997,237935161442167828,524288 --field-trial-handle=2284,i,11831266629941819596,1688594267761840390,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,15495034533488321124,9724709203772185137,524288 --field-trial-handle=2284,i,11831266629941819596,1688594267761840390,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,16996009979927334148,8347364841412424235,524288 --field-trial-handle=2284,i,11831266629941819596,1688594267761840390,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2968,i,8093356923348537989,17293718332687162972,524288 --field-trial-handle=2284,i,11831266629941819596,1688594267761840390,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5200,i,5325717263373999978,16929507278162483951,262144 --field-trial-handle=2284,i,11831266629941819596,1688594267761840390,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 3d16322050ecc23c2568638163005315d2a287e5114f263b7af848661ae54672
MD5 425cba7a051e72bdc74754780c7d9a54
SHA1 71a007268d3c23cf498f284475f9c3725b075c7c
SHA512 887c030ef68f8bd5265ed5c84af25d10b610fd8ea759037ae082026c69a790c9b4d665f7aa92468ed4d30e98e5adf7d994c60feead0adcc6342bf23ab8cb9721
TLSH
T1A4E07D8908CEC2BFA3406497427C778C82B0360FD3CC691A1B2C848C7001044F7FA7A0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 0511bd959ee6296df5f7600fcbd779bd81451350d67aa74d47a2f2bfe6621f81
MD5 ceb96160cac677a52dbf5221033c1608
SHA1 77d5a250d1ff836cd3ae8170c14352d352dd667d
SHA512 526f4585284e6b7a92575ecbdca1f41a4355a4d3d8f07fd7cde13393fa888766ad771e084ac43d0918a8e21a85b60baac21091b841359eaf26306396b7e7b8f5
TLSH
T165E0268D0ACEC22FA24064DB517873CDC3803E0F92C8799E5B7C85AC7202450FBB76A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a75716d0326e66eba44d1dc69b66903873ce96deeb672ad5a8a94d9ae36b3b40
MD5 48974280c116b256008b3bb57afe3fa2
SHA1 f810b7a7dae160056e6a0d63bb962281baa34cc2
SHA512 0c8536f6b850e81879c51210ba464c7a934fb86883d991a90809a0f05a2cf331eaa1a77dc9577e93f3ef08262422bf4086303d97f22ccf0a11c9eec18bf3e02b
TLSH
T19E715C283298158EE3E1F0B2E3D20F493BB44C894E4B5F1A1360CC7DAA13B2FC52157A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a92c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a92c.TMP
Size 3KB
SHA256 a33d74e9030793646ba75f543f396966fb48e102ce2fa46c7fac6c26f69cafee
MD5 6e5e0f073d0224f5fb828370e2a8812b
SHA1 4cebee883fd493308fa4255645ef27f17913c2d6
SHA512 3c2be91d570926caf34bf70d772cbbd9ec9202d08557d196944ee0c8b1bc66a72af7e8b522960332d203ad1adf6e6fe47c12e57174cc70c223b2e6d3825ac226
TLSH
T196715C283299158EE3E1F0B2E7D20F4937B44C8A4E4B5F1613A4CC7DAA13B2FC52157A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4cae3edcbd6024baa22ca889872957b5084436391cf43790beeb6c68d83e2c50
MD5 307e3a0fb533bdf910fed59a3f749461
SHA1 3a7384c9d934b3d49073ef3f363e142b65046e53
SHA512 56578b9fe6b0736af75d49c89b249d4dc1b98a8379b9b428f418849cff6f0e68fffd7eaa0c04d4d33eb8241869ea131ce829c4754f2604278433d12406297650
TLSH
T17D31A1B6C7D5876E881116F05B24BE2BDD1D050682283C5A9DE5EF1F63E20B1E10229F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e158736247a0eccbe832961da14ee6e136e7da247a37fb5ce8b38ea8aec1972b
MD5 afe7809a2e854f6b67ad0ab6f4a39185
SHA1 a94b6a238dd3977704876928464bae97c2f287f1
SHA512 73a0ba5e1e8a8151e2ef2326e9360dc624f6d2d1fc935a7170fdb14a3dd8b2398f5dc1c79832ac8f1dc41885c1e1b7d7a70beeabdc210dd834fc0cba767f8d98
SSDEEP 192:sxZhRYyM/jK1Ml8Mke/f5s7IZIdpdlHW6+WNGY4wOWq3IgrJ:sxZhaMe/f5s7IyPHbGh9
TLSH
T13542D716AA34597BCCDBD209FA517F53D6F95473A2900E84A9FCCA0C04E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b410be1329f0697429f1ace49e570dbb61c76418075c67d459b1990f55665c45
MD5 291218a0541d7ac7d04b82e48e923368
SHA1 804750eadd14c6cfbb40a8b96a9d9247ed19e236
SHA512 799278a8491feb4ffa4629a0f03e7ca93adaf221d7a9202caab65cdef0bb2197cf8b2cabd67f228cdc9b16b586b4512ae0b66d2a93999de972a2e6e28f01f50c
SSDEEP 192:sxZIRYyM/jK1Ml8UQtke/f5sjNUIdpHlHW6+WNGY4K3Wq3Ig5dJ:sxZISqGe/f5sjNNFHbGGJ
TLSH
T17A52C656AA34997BCCDBD609BA417F53D6F5547392900E84AAFCCA0C04E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9d1afe5d850c5a0d540746e501eddbe0d39c2e29a1fc56ba21c14c03ed03c8bc
MD5 64139f34c509a32e165b4d0536a06ec4
SHA1 5293964acb679201eece163ce979267b060e312c
SHA512 a6689967e7d599dab585c757fdad452f3fc2d6dd5a42fcbac0ec69085d2aeb10cbab0cdeb9d0405a9f20cdad7d170dd88bd94bf78d9459a6a347ed2d5f1bfd74
SSDEEP 192:sxZIRYyM/jK1Ml8Mke/f5sjNUIdpdlHW6+WNGY4HQWq3Ig5dJ:sxZISMe/f5sjNNPHbGUJ
TLSH
T1DA52C656AA34997BCCDBD209BA417F53D6F5447392900E84AAFCCA0C05E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 5996d07da29a5c369ec125baaed84f1d3395d3db71afa5aa107019fdfb6a8ca3
MD5 af99bc2cca9f9106909aa7aafec21b6b
SHA1 6a8895bfabac55aeac2b37d109568b0625850655
SHA512 1991f9ebcde43fa1da6274a017f70db20b76667d92cdc401a6a60431404bde9204f19a7a680828c8bd3d097ff40e21f4b9fc896b9bd7ce4f7e27f7e2a751875c
SSDEEP 768:Fl8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdmrowkqUnO:Fl8iJPNWvx76ru1jahALocddmUO
TLSH
T15FD2FA3B680CCB7E4F844E9CEC266F966DD801CB6B944D5447FA884C03CB7EA51269DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c18802ace9170ace12c381c0d10ce65315e85ec3c2b16664c37e6250ba7aef4c
MD5 64d71bf1d369057ba0d8472c2efbb4eb
SHA1 d87bb02cf82bcf7c1fbc1ea05cc1b7615ac8629d
SHA512 ddf3311bc8d48329bdcdbcbd4df3aa536726190d579c567c2d6e3203739adb596a53d5e92d7adc2d7b4f14aed666bde0310f199909bec36668eb10c67919ed1f
SSDEEP 48:Kvp8j3pzTxuXesIZvxKM4kJxYBhLWvTSyZII9Kw4xg7PxLrxivSsIhXxKw44Rxs7:KUacKL6SqIKKwbCEKnKWOjeKUog
TLSH
T10691584135BF42413CBE350892A09A664782F19B3329B43B7BBD01B20F26E656DFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9434e3af-5206-4247-aff6-64676df209c3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9434e3af-5206-4247-aff6-64676df209c3.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 0bab09675479e14c6ae4985f060ea2d8174b751001537773041ebcd8a34907e2
MD5 cd6733800bdeb56f62bdce0997efd661
SHA1 de72aaf287383f77a2e770ae7fb1de97bad935d2
SHA512 0915984c5d762c7b3adea5317c83a0622da48f0548705c396b0e84c5f08f96c5a37719c478126d45598aa046b5c4f2ed3a7e7d84d159b2a5712b64a0177c7a1c
SSDEEP 192:usLsNaAQW3amMTQmiU1kJ94k03/irbN1LIctqOU8:FsNaAfP0OSkWOpicXU8
TLSH
T19B323872AC786C3A5DA3A695F1473213AFB44067EBC92FC4E6EC971C05CB29C170B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 2f907808bd846c524cae2c5cf4d8341fc40cf93f01dd4ba8f21901b022c38b2c
MD5 cddfe3edd0449ef640b69aeab2b0cdb1
SHA1 e4f8f2160d92b706ac3e2d28932ea65ecbeed079
SHA512 7aeb96142a1806a35d5a56040528f39411bf446654fca8fbc33d0453411691358f925b346ed537a0548b57c56fc151858ad956a0f20bf6a4bd0877b1ce9d032a
SSDEEP 384:XiFiZcIdzsNi8TUNTUlIlMfP0OSkWOpHcXOObjI9G6w7cj:SFQlfwgmtcX29M4
TLSH
T1DFA27C739CA8893BAEA79E51F58A32279EF441B7DBC56B84F2D8DB0C019719C0706811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 83f7ffaaab0410916f689af7db293b343254511fec286d9b9e7c1dd58b88633f
MD5 f5078a8984d48143d4eda6c395cae1e9
SHA1 5d9f837f2f194d5d23c9005df62e383745fbb1b4
SHA512 86ccb28f55a8f78c0ca7664044d4606353835ffd4d308576679edadea58695056a98d00c4a30ea77befb82722f0e4a6a1916c94a5dc7fdfa02bcda7d83566bf5
SSDEEP 96:ZqONk7QsjpfmUTmDK5ih/cIPURHl8h4otop5RgO5DRgoBhPwivh50xy0SFYKDAxP:gONz6kDfQmiUyT7Z903/i+QicS6aU6
TLSH
T14802F93568786CBB8EA3AE45F48777275FE5213BEAD12F84D9E81B1C40D764C1703826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 3c9b122a6b609fc37f05f917bb4a72943ff9c4954cecafa976d8bc5069273744
MD5 a029922aad34c1fcb2f78109dbf4b192
SHA1 7aa01d7f348237602ba65081a19910d22f7980f5
SHA512 1bb9ac340a60af035e41d21a492b051e192f7ac1e3ce9be1c8c8370361aa5df72361157f835e28ded98eb4db431545ce4af49edaa8773deb9722764f0084f1a7
SSDEEP 384:cZcIhsNaMfP0OSkWOpicXOObjI9G6w7cj:KhmccX29M4
TLSH
T1CA929E72AC785D3A9DA3A962F08636276EF48177E7C81F84E1EDE70C05D75AC0B07815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ff18ce14a045059dd2708652ab842a317eca77c946396c7cf1bb671a9473a02e
MD5 23c8f20eaed2f9ea5f86f5c900d0a7a8
SHA1 78a3fa9c49c1a0e8b8861e32686782d7ddafd198
SHA512 d07ac132e2c747dcf87721393b83eb8aaf2dbb8599eff793828b0adb0a21a70423e10506e9dbe845436e70b9d87c26de1fa442835fc9c8a4a6e7eea5022af181
SSDEEP 96:rTqONkuYQsjpfmUTYUK5ih/cIPURHl8h4otop5RgO5DRgoBroPwivh50xy0SFYKS:yONj6kWQmiUyf7O903/irbNGcRctqOU6
TLSH
T12A123A72B8A86C6F5DE3A951F08332175EA44127EBC96F80E5EC2B1C05DF69C1707812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0e282dea42ce9fad8c92ef1774a88966865eb1c4bcfcbeb6eb3a98e3d4e467e1
MD5 3db68dc4169f3c97bba803e59f128cab
SHA1 2588624a41635824ba428f44c577ed92680988ae
SHA512 bc8049cdcb8f8ccc103f9bfc8f0403a71ae0cab3367b5932211aa75f4be2632f381714a7ad5da00c190e09f8ddc18b767f750df7267711a1458b24f87cc85447
TLSH
T175416C5C76F91118B3B76E5A9BF2A82D487ABD772E47D05D00010E4F0A22B00C8B2B37
MD5 SHA1 SHA512 TLSH

Submit Download