hxxps://github[.]com/soporte-2507/cancelacion/tree/main/santa

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 23:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/soporte-2507/cancelacion/tree/main/santa
Sample260730-27wckaha76

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4592	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299268485350560"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{397A542A-550C-44AF-B089-311BDE93FE56}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 4544	5016	msedge.exe	85
PID 5016 wrote to memory of 4592	5016	msedge.exe	86
PID 5016 wrote to memory of 440	5016	msedge.exe	87
PID 5016 wrote to memory of 440	5016	msedge.exe	87
PID 5016 wrote to memory of 440	5016	msedge.exe	87
PID 5016 wrote to memory of 5248	5016	msedge.exe	88
PID 5016 wrote to memory of 5248	5016	msedge.exe	88
PID 5016 wrote to memory of 1840	5016	msedge.exe	89
PID 5016 wrote to memory of 1840	5016	msedge.exe	89
PID 5016 wrote to memory of 1680	5016	msedge.exe	90
PID 5016 wrote to memory of 1840	5016	msedge.exe	89
PID 5016 wrote to memory of 1680	5016	msedge.exe	90
PID 5016 wrote to memory of 1680	5016	msedge.exe	90
PID 5016 wrote to memory of 1188	5016	msedge.exe	97
PID 5016 wrote to memory of 5744	5016	msedge.exe	98
PID 5016 wrote to memory of 1188	5016	msedge.exe	97
PID 5016 wrote to memory of 5744	5016	msedge.exe	98
PID 5016 wrote to memory of 1564	5016	msedge.exe	100
PID 5016 wrote to memory of 6084	5016	msedge.exe	112
PID 5016 wrote to memory of 1676	5016	msedge.exe	113
PID 5016 wrote to memory of 3312	5016	msedge.exe	114
PID 5016 wrote to memory of 3472	5016	msedge.exe	116
PID 5016 wrote to memory of 3472	5016	msedge.exe	116
PID 5016 wrote to memory of 4180	5016	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/soporte-2507/cancelacion/tree/main/santa
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7fff1895c188,0x7fff1895c194,0x7fff1895c1a0
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,18376163235100818616,10895494862608976233,524288 --field-trial-handle=2184,i,14990367639703579401,7209364314028875627,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,6519548665917690507,6079333074102736310,262144 --field-trial-handle=2184,i,14990367639703579401,7209364314028875627,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,15422008263884784632,12223208801997251842,524288 --field-trial-handle=2184,i,14990367639703579401,7209364314028875627,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,11564324465146527242,4946365203470469991,2097152 --field-trial-handle=2184,i,14990367639703579401,7209364314028875627,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,9934975396841334179,12340121043939134812,2097152 --field-trial-handle=2184,i,14990367639703579401,7209364314028875627,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,238122346890569519,4937436297136745475,524288 --field-trial-handle=2184,i,14990367639703579401,7209364314028875627,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,8564910070569072897,9512165342230321797,524288 --field-trial-handle=2184,i,14990367639703579401,7209364314028875627,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,6766692697196396078,7420386149140811459,524288 --field-trial-handle=2184,i,14990367639703579401,7209364314028875627,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,6766692697196396078,7420386149140811459,524288 --field-trial-handle=2184,i,14990367639703579401,7209364314028875627,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,4154230017044658969,6132749810773929179,524288 --field-trial-handle=2184,i,14990367639703579401,7209364314028875627,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,12344699036127699088,11231777262640013201,524288 --field-trial-handle=2184,i,14990367639703579401,7209364314028875627,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,40482293967968599,4621413063232278257,524288 --field-trial-handle=2184,i,14990367639703579401,7209364314028875627,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3036,i,11613347155878138319,16911943761627544236,524288 --field-trial-handle=2184,i,14990367639703579401,7209364314028875627,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6172,i,7590207133061589757,1021446223291512633,262144 --field-trial-handle=2184,i,14990367639703579401,7209364314028875627,262144 --variations-seed-version --mojo-platform-channel-handle=1848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4180

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

126ff963-87ed-49fa-a3d9-bf79b44ea4c3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\126ff963-87ed-49fa-a3d9-bf79b44ea4c3.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 25e368e72a06aff9b6495d5d1a8789668c772edac09ff158c27350625d378f45
MD5 cd6f870d6740a775ed206b9a69b72910
SHA1 dad110210e8c251164cded38120527f32f7ffce3
SHA512 1830aeb16cdcfe0d4ad2f1caf71f719ed6a2d89c6ee6fe5a07f618d5c8488e0d4805e4060cb8033f22e6af154d6d426b12555398400f47b40ea365483b56be62
TLSH
T150E022BACC26EC2B1CFD076CA0098656E710139B3A44899F3A7C920D8FB463A86C5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 acc8c982092043ff3f79e091f095d262177218e42785fe7095ea2977e18f736f
MD5 db461d043b987a15813ba2411ba19ecc
SHA1 7246b40ff4f871a87179ac228db2678cde36914a
SHA512 666516ab2fbc75e67deb4942c20e3549204cf206f5dd3c01244468f04873b2266dc4fec4169e49c90d7c0b5e163315c616618fcede8009f479d6787e8156430f
SSDEEP 96:d1c1PWW3lmBrXfhRluPa6p5chcgjpXjo5A1h/:XcFWWVIrfhR4r2hLdjou1N
TLSH
T1A1C190FD19C267A0CB93C73180F1DB9B39718EE9F0579EE6CA841434170A38278AC90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d71486d80ab396e1ea1b285dee8ce083b60f6f647c5a6f14546ef1c38713969a
MD5 aa94e8e0167c836a576835ca5d7885f4
SHA1 3e7bb50c3897e3583e8197f89bf1636afce18d9b
SHA512 681ef41b203aca5bbd3bf3cdd05eb8227a729becd08b6890c28573b2fe0d4371bb2f4f54d81237f967cf47f54a6dd8f5112f99a7283f8d69ad8d425f853d2eab
TLSH
T19131C0F7C3E8856E8A1095F0B618AE2FDE1D0510432C3D9AC5E4AF1B93E2471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 64756976d911c74b7edbde068260c5230cefd4fc3d0f32b9e81233044904ef93
MD5 0687863acc3c21bc7d06df8a08402ba0
SHA1 8047cfa03ab8e8868deebed2ae5fd2a7846ba943
SHA512 6347fe70886678f0fcbb867957626bf27b685e8a13e8791e5de1d743b8c95975faabfd7653aca50164e7bd346093f57e436a12aeb1fb76299e47191ac4440c44
TLSH
T12F5189F783F1856D9A1195F0AA08AE1BCE2D0520831C7CA989E0BE17D3E3871E14175F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 28a7652316ce638e856480cadef6b0de43a7b766df85e307fd1b04e18a0c04be
MD5 5b7a25cae8b2ad967be0ab1643a997f0
SHA1 e633636411f9f6b608fd043fbcdf6fea70188a6c
SHA512 3b61dfe572187e514dfcddd0c09154158cd319d501b07cda15b9c61aae861c87ac4b53f633a40c795f2d20a3d23860874bbf3417ed86293ae912e00a520c1b14
SSDEEP 192:sxZNRvyMqZjK1Ml8UQyk8/fmsmCZdtzodpvnTHW6+WNYvA/YvVGjf9Ig5pRJ:sxZNEqx8/fmsmCzmrHbV/Zpnb
TLSH
T1A872E816AA7459779DDBD21AF6857B53D6F90023E6904E44A9FC8A0C00EBBED630381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fbc8a737886e981b9fc57d060bc014c31c599f9dba3baf99f1aea54f4a365ce6
MD5 d0c390656441fd11367e0aa8063a2fed
SHA1 023efa696c035a8b1e6ad15b0944fba89b0cfb9a
SHA512 a9dc56997686644260612956ded67febefbe2e426c988a604220c411dd9c0fd3815e4ad9e3a09b98c241d4710d3e09ce57eb69309bc4221e1945bf532cb14d58
SSDEEP 192:sxZNRvyMqZjK1Ml8Mk8/fmssrvaZdtzodpvnTHW6+WNYvA/YvnuGHf9IgjRJ:sxZNEM8/fmssrvazmrHbV/qpjb
TLSH
T11572E8176A34597B9DDBD219F645BB53D6F91023E6904E44A9FC8A0C04E7BED230381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 60cb2f0d401063a3094f2f6cc67046b863d1612d7e7620eb3ae2e26145a96390
MD5 97b090c387b74255d26ca38eed910fa0
SHA1 26f1ccdb55cbd10841d4316db2d315eb8e840455
SHA512 c0e6b865cbe06eac0e9345cd31a307077483c050ead86eff4c05e6c64955d416aa2dc84a0e3478fbfc5d23ff9ae749ecb46cdb75c4ee213b0bce5ecbe5c0ab4f
SSDEEP 384:0LppY93PBZJPtN53TiRMNB7/zy/m1ZVBtTChBG7h:0LppY93PBZJPtN53TiRMNB7/zy/m1ZVj
TLSH
T19CB26B5A703B0211397E2988B39696364F4235A37058E4BF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 9a62bbf4e1831b8c1eea42f649c7f7580602bbc74e781dfa52b85d0929a2310b
MD5 81765ba2ba5605ecfc9e567e262ae482
SHA1 0d3da44297aef3dba301ccaba7d5731489d932d2
SHA512 056f339060078ce9464f94ec12526e636339aa66f2ac275423cf60f871e2ecd54f684360695f87508013e74757376ebfe76eded8b4b33df6b0b126a912cfc0cf
SSDEEP 384:nliFiZcIzUO3sNA8TUNTUlI4gQckCrIZ9phiftGgEM9Dg9gmtRFdi/USOObjI9Gi:sFQn39wg7kZzoGgLggmXLi/US29M2
TLSH
T119F2C2F698D78977E8AE4B87677D2E0299FCC113B5985984B7C85E0CCC960BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 9e2d277259abf8a1df691a02f40e7367b91508c0d2c52cc869fffa22f3d24b27
MD5 99d8e8049b8bd1a76b06dcf8563e67be
SHA1 bc15392a97e8e06757e58e4641b046128db2ceac
SHA512 ca9734a8900cb29119fbed94182c8384fb9f6272ee5a9db20dad94614fdb404313dd70bc7cee0f7a69f4d5165ce7d43be2526b24da563c2315a9af00d61638d6
SSDEEP 384:n3iFiZcIQ3sNA8TUNTUlI4gQckCrIP9phiftGgEM9Dg9gmtRFd7USOObjI9G6w72:yFQQ39wg7kPzoGgLggmXL7US29M2
TLSH
T190D26C32E864DAB7ECEB8E95B7493A03EEF44163D69C5AC8E5DD5E0C00970AD030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3c1de569923dbad7318dab7395914717971031b0178f8e009bd42c724bc63914
MD5 9fe714bb4b930bb57342d1675b40b0b6
SHA1 9678a9000f277fce196e4da7799f675b5a98ce6d
SHA512 794388e611a32b2729ee666ce9bb764ee7de5bc945a8c06ed1ca92fb10a288050a2d9f33fdf49e47138a85a50904ad2d66ee37deb4e759861042e9b78b27393e
SSDEEP 384:npIiF9CcmyWCs3sNy8TUNTUlIm2QckCr9lKKphiftGgEM9Dg9gmtRFgNpAe4KV8x:pTFccps3DwgbkU4koGgLggmXOQI8p0KX
TLSH
T1AEB26D36EC58DEBBECE74F89B74E7A07DEE41267859899D4DAD81D0C009319C130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d974cc0e6d132030167a360ea373f4d315278cf0c0b3cabf09dac585d1fb8db1
MD5 8b1ad17330a6a663db4ab4ad0433a41a
SHA1 de094ac766da00d9d84a31f75c83b5867d0b5292
SHA512 1900f0a56ebdcd3ec2cdff069c583ff4d4d2989530ff31ff41712039fea2a57462f941c5a629ee594afcbdd499fd64a18f54132dd1e99a0d3c923e991777a957
SSDEEP 768:pKFccps3NwgbkUcQoGgLggmXLsUSI8p0KX:Is33peXHI8p0Q
TLSH
T19DC25C36E858CEBBECD64B99B74E3A03DEE44227869C9AE4D6DC1D0C00971AD430BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f3f40ddfaf5de7b319b880d69c486d8ba52b71cbd4283037e5f2ef7b05b713e9
MD5 ba5895724789d41cb73384a451fa7949
SHA1 08985b983f0e646b65ccedcce69556f10a860498
SHA512 acc1f6ec942a2ea9f6b528b54c2b570b4347abcb5848e359256d22610e3164a43852c6675bc9259ef35e8b4934765a2d1716e5d2f2e6104157322aaa532cb1e0
SSDEEP 768:p1FccpK39wgdkpzoGgLggmXLBUSI8p0KG:rK3BSeXsI8p09
TLSH
T156C25D32E868DDBBECE74B99B64A3A03DEE04163869C99E4D6DD5E0C00D71AD430FD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8e94029a7cdd138cdc1a4ca429e057fa0459b5d473497c038933402c556092e6
MD5 c9990410a8944a25827f13e9238267aa
SHA1 f33ce8cf67056d8d6a6243bd957b1d0868f0d4ca
SHA512 f15f23cb56a53c20e9a79f4ad2a9b3b60ecaf9770e55d3df6279e552b67a546ef2cce6c4b68a761064da7f2778bc6a94b60d75e424a622296b93fb9d22b27f64
TLSH
T1D741FC5CBAEA1148B3B77F5A9BF6686D483F7C772E4AD45E00110D4F4622B40C9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1564-370-0x000001E813EE0000-0x000001E814EE0000-memory.dmp

Download