f0b678edb8e3b8f8ae1c9ef6f237cd9cdf4489d5d432227360d6fd7c9f392c6d

Analysis

max time kernel
899s
max time network
729s
platform
windows10-2004_x64
resource
win10v2004-20260513-es
resource tags

arch:x64arch:x86image:win10v2004-20260513-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
04/08/2026, 05:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-1.html
Size 21KB
Sample260804-gl43csdh88
SHA256 f0b678edb8e3b8f8ae1c9ef6f237cd9cdf4489d5d432227360d6fd7c9f392c6d
MD5 f90372b1f4526a4dc32e2439ecaeb6ae
SHA1 6c071c6d8111ca242f7fbc25b99370c2e55c4699
SHA512 f280e8b7e923b43ddca61e66a7849ca7b6f000989aecd2c86cd26c5057a80d853ef32773662119a49189e70e2cb38332585b35848b78f68f04fbf604fb4e31d7
SSDEEP 384:R7eWDMvGts7x3otJZJfCQPf1WQ/cXdKLQHUr8Tb:R7XEuT3EN4LQHUo3
TLSH
T1BAA2759A83C6599E583761B9F4226F9CE7E0580F92214DF0F47F72278F8940246AB7DC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4332	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302965162523454"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{368FC6A8-D71D-4E85-9F17-85737B22FA8E}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 3376	984	msedge.exe	86
PID 984 wrote to memory of 4332	984	msedge.exe	87
PID 984 wrote to memory of 3816	984	msedge.exe	88
PID 984 wrote to memory of 3816	984	msedge.exe	88
PID 984 wrote to memory of 3816	984	msedge.exe	88
PID 984 wrote to memory of 3808	984	msedge.exe	90
PID 984 wrote to memory of 3808	984	msedge.exe	90
PID 984 wrote to memory of 460	984	msedge.exe	91
PID 984 wrote to memory of 3184	984	msedge.exe	92
PID 984 wrote to memory of 460	984	msedge.exe	91
PID 984 wrote to memory of 460	984	msedge.exe	91
PID 984 wrote to memory of 3184	984	msedge.exe	92
PID 984 wrote to memory of 3184	984	msedge.exe	92
PID 984 wrote to memory of 4656	984	msedge.exe	93
PID 984 wrote to memory of 4656	984	msedge.exe	93
PID 984 wrote to memory of 4656	984	msedge.exe	93
PID 984 wrote to memory of 1912	984	msedge.exe	94
PID 984 wrote to memory of 1912	984	msedge.exe	94
PID 984 wrote to memory of 1912	984	msedge.exe	94
PID 984 wrote to memory of 1308	984	msedge.exe	98
PID 984 wrote to memory of 4992	984	msedge.exe	99
PID 984 wrote to memory of 1308	984	msedge.exe	98
PID 984 wrote to memory of 4992	984	msedge.exe	99
PID 984 wrote to memory of 3404	984	msedge.exe	103
PID 984 wrote to memory of 2224	984	msedge.exe	110
PID 984 wrote to memory of 4792	984	msedge.exe	111
PID 984 wrote to memory of 4748	984	msedge.exe	112
PID 984 wrote to memory of 1960	984	msedge.exe	114
PID 984 wrote to memory of 1960	984	msedge.exe	114
PID 984 wrote to memory of 4732	984	msedge.exe	115
PID 984 wrote to memory of 4792	984	msedge.exe	117
PID 984 wrote to memory of 4584	984	msedge.exe	116
PID 984 wrote to memory of 4792	984	msedge.exe	117
PID 984 wrote to memory of 4584	984	msedge.exe	116
PID 984 wrote to memory of 3120	984	msedge.exe	118
PID 984 wrote to memory of 3120	984	msedge.exe	118
PID 984 wrote to memory of 2004	984	msedge.exe	119
PID 984 wrote to memory of 2004	984	msedge.exe	119
PID 984 wrote to memory of 1076	984	msedge.exe	120
PID 984 wrote to memory of 1076	984	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-1.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffd968ec188,0x7ffd968ec194,0x7ffd968ec1a0
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2020,i,9383524840705059614,12191135148296642968,524288 --field-trial-handle=2296,i,17608199917510956240,8913433455661183774,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1864,i,6707250825972996230,2983904242391796039,262144 --field-trial-handle=2296,i,17608199917510956240,8913433455661183774,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,1146578775306106161,10334301899880566525,524288 --field-trial-handle=2296,i,17608199917510956240,8913433455661183774,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,9653100233403809988,14376195637505842276,2097152 --field-trial-handle=2296,i,17608199917510956240,8913433455661183774,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,17022005088362574049,11400973583207397716,2097152 --field-trial-handle=2296,i,17608199917510956240,8913433455661183774,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,15353630781099445397,14092438114367312656,2097152 --field-trial-handle=2296,i,17608199917510956240,8913433455661183774,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,6964695869933994227,8376259177025328170,2097152 --field-trial-handle=2296,i,17608199917510956240,8913433455661183774,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,2632932302961784240,354676165070391824,524288 --field-trial-handle=2296,i,17608199917510956240,8913433455661183774,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,10110323413029576668,12733012401786420328,524288 --field-trial-handle=2296,i,17608199917510956240,8913433455661183774,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,17185731319759999045,12393427749571454912,524288 --field-trial-handle=2296,i,17608199917510956240,8913433455661183774,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,17185731319759999045,12393427749571454912,524288 --field-trial-handle=2296,i,17608199917510956240,8913433455661183774,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,1749546102550068669,17401720677700513141,524288 --field-trial-handle=2296,i,17608199917510956240,8913433455661183774,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,4882919056656626620,10386052942928320063,524288 --field-trial-handle=2296,i,17608199917510956240,8913433455661183774,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,11349615877081722071,959806546756575957,524288 --field-trial-handle=2296,i,17608199917510956240,8913433455661183774,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,3725765736873264055,16271880109861057843,524288 --field-trial-handle=2296,i,17608199917510956240,8913433455661183774,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6184,i,13380136812427335773,16840443660231564780,262144 --field-trial-handle=2296,i,17608199917510956240,8913433455661183774,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3304,i,47796827100245238,5352301870044689514,524288 --field-trial-handle=2296,i,17608199917510956240,8913433455661183774,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,7123889672951485479,4663596957075633347,524288 --field-trial-handle=2296,i,17608199917510956240,8913433455661183774,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,16585356139779027445,509466730356120688,524288 --field-trial-handle=2296,i,17608199917510956240,8913433455661183774,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,10913067432226378763,18160573948478153418,524288 --field-trial-handle=2296,i,17608199917510956240,8913433455661183774,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,6325707244605603780,15456821172469386758,524288 --field-trial-handle=2296,i,17608199917510956240,8913433455661183774,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:1076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 17d500b4417e92837c05a8187f43f060e09191612c25892f2c54e786bd254c36
MD5 ca52a84f03e904e79c2a5651b273e5fe
SHA1 61ddeaf1850d81986389db97ff9470b67eb8cb1d
SHA512 d1f489b74d4da21280e354fdfd91d6569edfcb1abc7f4f6740756bbe744f02bd51136d5ea47c7a6a1842683dc3eba0d2608d4d46e5eb8ffb5035ffeb98f9c788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7G:fwUQC5VwBIiElEd2K57P7G
TLSH
T1B9B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 c6be8a29c2d1106e94079d3120860cc15e6d3ae6c01596deb1bbba93ae93db6e
MD5 99174581dfa11a1799fc03ed5b71864e
SHA1 c6ef1f3a76c3b1bc189aabf083c84b82ba926d4f
SHA512 2004ed397b7b15664f7a523d31f3288f9f5bf368ea8bb0d0c055821490a5be55ad8dd05266b8bf7a8c9280caf155e8723f85861636b827b440c593d5f52a4e44
TLSH
T1EAE0265B07C6E1A44A02968BA8486FDA71F0711EED8CD8DAB21878CC38C1209D375DAC
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 99491f00c7ed29d242a2797ddef5069384daa16af2ef323a257374fcfe8e20d3
MD5 38c253b034da58a9f66b7f41d739b840
SHA1 5211ef18998850c6b48161d7b66ab7492712c5a9
SHA512 1f3af1cb5607a411389b8761746eec424b5f82416fadb1e0acebc75595a5fef12d4f40abe20e86b78f283f4160b9128e8f63656bcecfb206f48dc1b696087a2e
TLSH
T11DE026C509CEF22E9621E54796688B8C92C03A0EDFC8B9CE572884C83001290A3C3AA8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 9a3d9dce86dc5c5e1bc74b3522e95749a9598957e6a838b0ee267886eabd14e9
MD5 2bbc023dd81b56d1a311c756846fbb9f
SHA1 c8ed9f4b0675790a157ae7b710c02a66d30d5e9c
SHA512 33b20e8386bac4210975d5c1799885a4828b3d85535099d06418c2c6c164598515e685547dce9a227e6dfce2d99eb517776d22791a422c72cdbf946cfd085d05
TLSH
T197E020D804C4C27DD52C6447B254770DC2D0374F9FC4BE5D571487883401544E383BE5
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 be2e2ad3d2d4437b412cb16a303d64dd4b6ab3083900a9d243427ec596d8eeed
MD5 6fff17dea4e1c6b71e66ba8e014949ae
SHA1 5669febf3b564d1634cc4fed80d3849e9a798721
SHA512 d2b57ebe94d2ef2a4bd23c9b1adef5c6184412a8242e7444f0172ef34217d44e28b52f0ce6c21321bdf41936e2dd277bccd55e1e7570e44b515371fe0f8ab52f
TLSH
T10BC08098B98C845DC285187EA726F00007606561941796135560BCC03140DB01E2E120
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2fc1f9e7d34cfb9c524cb02c08c026925369098c881af40d125059bc18d1db3f
MD5 ed048dffba6e24580e994869b2f738a9
SHA1 ce4579545583f1c9f52349113658345f63bdf96e
SHA512 95b5427693f2d6f0649b97c3db6ee89d370e28be5326f49bd0feef66c275807c52aa19f41261f987b7e82c8d1a46acab79bf42cfae95117119ff7e3408a3b32f
TLSH
T18F61701442523FBFF3E29131DFD1C6E37272C0855A2F5E8A27E8B476A61E7A09325039
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589a86.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589a86.TMP
Size 3KB
SHA256 a3dc6cc69781939143d71ae7aa70906a70ee5cb13b0bd65ec41af7eb1b4f5b80
MD5 fabb5b8ad25948499f058e59ceb21824
SHA1 a203ef74e29c7affc481b2d40fd6c66fd3be7bd9
SHA512 ec0f99636bf5733bd1459a984ccea300a3a399037d7a7072beb53fcaa3e13be8cc56b03d1995bc5d47a2a143aa42a5efef888e2330e17af2ed0e1ccae47b740d
TLSH
T1BD61711442513FBFF3E25131DFD1C6E37271C085592F5E8A22E8B476A51D7A09725039
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 673B
SHA256 3fa8580e357d0163934f24fc2ee33c8d9f1e05facb7b8cbbae9ab426b8c5dd75
MD5 1629cd0c7a1d1ef1d69c705394c03d90
SHA1 181c7da73573b9545685fc7d7096124d1550216a
SHA512 f8a41f705a8cb43f0ccc134b4c6c0e407ecc9ae60628256a2875a2cc99767aa92e8c48ab5ba18e5746cd2254dfe38b0c4104e5074dd55dbc3fc52c4b043062cb
TLSH
T19B017BB287E5556E895112F099287E1BCE1D0501431C3C56D5E4AF1B93E2025A101D9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 478B
SHA256 d7e0871fe4a940cec8fb48b456b9a6df0837e4c8a57d7a829bab43553c0131ae
MD5 774918a19a1476eaf1f14c8644226280
SHA1 65936ee2ce4dc717c351b27a644480faf7f831af
SHA512 1841695351a1502a49280bc89176ad4c96fb748abdc13bb58637e76b192686a8b462ae73e2d7c68dab182d84a969400e3ec1105847bd30506bf3e9929f7ba86a
TLSH
T12DF09EB383E455AE8A0042F05618AE17CE2D0402431C7C65C5D4BE2B93F3474D00089B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1206d9e83644f49492928f31273dc58ea27bc28e8dbd2c27a9287e24f0be0d63
MD5 b3852820a5f57ddd533536f51ee9fe93
SHA1 3fb648a59d226314e1e5b1883a1f1020ec32742c
SHA512 fb83eeb14973bce43054bf2631d2c89554756d1fdd26f6d4129efddd86f57d32e7e0e2a741717a8f47480f7142cbeeb4b08069219cfeb22c23aa53b784243109
SSDEEP 192:sxZ5n8b/ywFaKOMl8UQo6koZ/fIUXsoVopb5A+MIupH5mHW6+WNGYw+E5IUgT6qf:sxZYXq4+/fns2EyBcHbGgpv3
TLSH
T147520901AA34A977CCCBD209FA55BF53D6F5043391941E48AAFCDA0C05E6BEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 98c3f856531fa35ebe912a36bd99ded15a3910ad529e4c0247216b7817b50695
MD5 895090c2b6785f93b49754607edee130
SHA1 d367c9a8aeb986ba8578f915e93a6da8ee29a063
SHA512 f9d53606e1a3a2d96af1b3840810be9f26235c047a9540b528b0a664008932f28de2c3a6dfc7b39d943ea558ad93779e90a7e9a6509859b84fb9680221189a8f
SSDEEP 192:sxZ5n8b/ywFaKOMl8MkoZ/fIUXs+fb5A+MIupd5mHW6+WNGYwK5bUgMT5M8IgrJ:sxZYXM+/fns+jyBWHbGM+9
TLSH
T1D1420901AB34A97BCCCBD209FA55BB53D6F5543291941E48AAFCDA0C04E6BEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 5ca66e1dc97d262f9b454b635dc54be065972e066a900dad975598658db79e67
MD5 0567bb8267d7f7443d303f1073db96e4
SHA1 345de033cd2d363d339b58919132bf6401557539
SHA512 b759cd89cd25d245844e1dcf7a18cdc6b918f42c452229736b70971c93ba2862d9622feeccd7c90b9ca6f089795a64d0808055195788a50b4cbe89aeee4b8823
SSDEEP 768:mJ4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOPLlrZ+dNroh5cHa1:mJ4jeXmWvmKLEu1jaTPLZQdmwm
TLSH
T15FD2093B244CCB7E4F844E5CEC2AAF966ED801CB6A584D5047FA894C03C77EB512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 1KB
SHA256 47f15f187d19a1a5784a4d05e1736191f6382ec01a59a89f0ea918148c45c1ac
MD5 e858e5244ff16e150ce39bdf50f3bf73
SHA1 7cda89c310dcdfed7dde32ae778b5025909eefe0
SHA512 79b6f94b1565ff43520edfc45b5b2b094c4095533946f71a92c9d45608d20e82a898ddae60e42b892fb3bb2010bd5b92608d91dc730d9f4fedf6689241b964b8
TLSH
T1A731634A8E919D5FE86845B30573B8B833708DCC4A22E713587C32336E26759168B1EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ce036.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index~RFe5ce036.TMP
Size 1KB
SHA256 e149cf3dfd325ef2e50a06d0c84f2eec103933f8c586d4a024ac6d65bbf618f3
MD5 ff78c1e76fd81dd54374cd05c550ca23
SHA1 edd7935627d38c326b9c5f0cfdb7e5f92d29b27b
SHA512 8344fb2b82b6a8172cdf996496611f7a39bceb8f8bfe88c85df78fae7720edc7fc84f308189748699e6a7a8455ab55a4d391519ba5166776216c3f5de3eddbae
TLSH
T1F631234A4E818E1AF89450770AA6A4B87376C9409321B793987C6239AD31B9E2E5F0D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 0a7c1323ac64bd7ce5812b7648c5aec46e9e393dd127b0090eb12c39901b5b10
MD5 2f85800efd2ded9dc5bcd64694abd88f
SHA1 993c813e7f06be879cba29742f47f199cd756c5f
SHA512 90e4e783cf18f84e27155b84c3b8f671d4639e68049d32e9693edc891ef0da387275a3dfc877e9cd9f5236bd529d3fe147b9b78c4e25a1d019f42cfbc9b2168b
TLSH
T106E068F62CD72E20ACBF47E628B204A44106B8288591AC8F2016B2E750A02682016C20
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 80989a867770ba208032e4e0f37b7a8b211e97a82e19fcbf5aa539fce6d90f82
MD5 59770495c9948f52b851339d11bf7818
SHA1 0ef08c35764107eaf32699cf5d92ddbdf5da94b1
SHA512 a1f38cbb156e74d3d98918564861f757ad57011aa30f050d0407c7ff490d18259132046f561e3fee320ca5e3b8ea7d1e5b18705f5df4ca7a2f83b4cea7b87bec
SSDEEP 48:KwPIlKgcA7yhOIvK7S0Se9CO0AMkcALPILmkKqBiskWu0Nr0u5yKa3u6skk+65:KwPaKgcGCOwK7S0nOKYIOTa3u6skk+65
TLSH
T15E91002274BE52137D7F6B4D83548A1B4A42B1A374A9A42B7BEC14B60F66E104CFCCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc2bb026-bd54-40e2-8404-9301657fa476.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dc2bb026-bd54-40e2-8404-9301657fa476.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 e7dfcd2af3cefc7ce57f7bf6991d35a5d20958cb42766f953d9e1c76fae333b6
MD5 5cb2b7e81b4702abd9866dd283d10b96
SHA1 5384d524ca48437435a367dbbc158070ce70493b
SHA512 c5558f99f45f9b2e4cc7c7fd80211556401a16d808a8b34aaccf6cba23f5b5a5e834235a19cf251015bda0baa50c8bea1b0a20624e7e483f5a039e0d86134f85
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uQ:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAZ
TLSH
T168A2B81DC81C7E3257CA2F7D6A2F9DB276CA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593649.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593649.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2ab90ebaaf5e34f13453d45ae8a07cd02fcde4ca1b0bb2f4da1da66f7940da4e
MD5 2aaee6592b4558baf07aad59dc87c20d
SHA1 943dba6cf2adcb909b4b292e70a2816727b12f25
SHA512 3398ba06bc06ed113e6b5b31b8e07c049b052850869508ec4709a970ffb34f4d4d947b4dac885c6a2a43de8f65f4fc5e59c1cfc0366e46f034bb1d8ac82e2290
SSDEEP 384:UZcIhsN6ECddFf+QG8dY8EXrlFDBeRs9JKgqijUQC:ShxlDdMjDTjKgqmUQC
TLSH
T13F928E319878A97699E2E681F08B36234FF49427EAD47FD4E5EC7F1D008999C130F926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 04b96812a467320fe3a670e2f42a03ced664bead40cf643dd483742973fa3f96
MD5 4ee622f273c85ac6a4611296eece4f29
SHA1 6840101b0d819e26c2520f2f109e1bf641bbb138
SHA512 9ca42297ce8991ed638a44a5ade74667d46f3ced72a573e4637eaecdc6b53654492333061fcbb5f51cae97244161ada54f203f2943292f1947ef60bf977350b0
SSDEEP 384:HZcIhsN6lCddFf+QG8dY8EXrlFDBeRs9JKgqijUQC:vhMlDdMjDTjKgqmUQC
TLSH
T139928E319878A97699E2E681F08B36234EF49427EAD47FD4A5EC7F0D008999C130F926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 c0a3241c0310bf261c1c09c882940abd98aa83f7574f23955fa2c471f9b6fcf2
MD5 288ce277a9a5a10c3f28428ac1cf73c9
SHA1 bf814c7b5b65a3517ff18e6d5ace5fe2a0897cf5
SHA512 f54084907e8cda846993e0cff1839266a3d50b9b9b7e11f74037a2248301195b7af1c050d4f4c2998ba15a2e2f6f896bbb842d0adf693bd47cf268f9b6083edf
SSDEEP 384:967FiZcIDzsNC8TUNTUlIllCddFf+QG8dY8EXrZFDBeRs9JKgqijUQC:0FQHnwgElDdM3DTjKgqmUQC
TLSH
T140A26C3288A8D97BEDF6AA81F54A32138EF45067DAD4BF94F2DC6F0D004A59C130BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 97f338727a150d3253e46cfb5308a3f05c848d653e4c50395ffb4bd7b4f93423
MD5 0f2935ab6c287a3243a76d65ac750f86
SHA1 790cb14a05e922248b438bbd0842d4e0fa52eec1
SHA512 bbc42125e786b12979dfc4d270a957d9686ab73cb6e464f2a8ce8fda0891c2913753c9af656ecbab3a32d1607c1234293d9d8ecfcc3a0a5ca897ed87cc9e680f
SSDEEP 192:EONs6hZ0QmiUy545Wpc/+jVKajzordYc5wOZqBHU6:EONs6o2pu+QG8dYj2iU6
TLSH
T1F002DB35A8686C7B89E2AF45F48B37235FE5112BAD956F84DAEC1B1C00C769C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c08b009d9015dbb0e55bb18315d23326245f600182f481cb97f8c16482c03928
MD5 5d93abce9d3dc2ba40ebb67131e5c560
SHA1 8aafe18b3e52eb45b94ce49a76d93e751e2e5caf
SHA512 e39939bd9ab25f6171a662beb511c71ab808333313b1f5f0a0db391bf4a5cb015fc6e2c2c298b00975fdcbf61f50d83222f91d900b96d23dc6c64e4de171c67f
SSDEEP 192:bzONHj6hZXKQmiUy5k5Wbbc/+jVKajzordY8EXrchZ5cOqq0qqU6:3OND6KY3u+QG8dY8EXrj9DU6
TLSH
T10D12FC36A868BC675DD2A541F08B32235EE55127EEC97F94E6EC2F1C00DF99C134A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a572c9ed6b36d91169a9ef9bf9e026b9f14f550ae2aafb6b186cd52b8dbff6d6
MD5 86e888546a647d457d73018fededc84e
SHA1 b981c5f64f203e204aff1c39d34efe7d34d07904
SHA512 06f61b7f0a8c9dfe4c79d4a28398f563e8faf1c487c5eacce53c3b58004d3012d4342113bd6f51b6f476ff4326ea6a55c737b6782a2329d73b229f035307eb89
TLSH
T155413D98AAFA1144B3776E1AAFF6986D847A78732F0AD55E00110D4F0933B40D8B2737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3404-186-0x0000023F98350000-0x0000023F98499000-memory.dmp

Download

memory/3404-185-0x0000023F98350000-0x0000023F98499000-memory.dmp

Download