hxxp://bbva[.]es-empresa-consulta[.]com

Analysis

user interaction
yes
max time kernel
898s
max time network
734s
platform
windows10-2004_x64
resource
win10v2004-20260513-es
resource tags

arch:x64arch:x86image:win10v2004-20260513-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
10/08/2026, 18:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://bbva.es-empresa-consulta.com
Sample260810-xcfleaaa53

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
64	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308609501974688"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{4EC6C841-B8D4-44AA-B476-1621773644CD}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3856	msedge.exe
3856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 1492	2440	msedge.exe	84
PID 2440 wrote to memory of 64	2440	msedge.exe	86
PID 2440 wrote to memory of 1116	2440	msedge.exe	87
PID 2440 wrote to memory of 1116	2440	msedge.exe	87
PID 2440 wrote to memory of 1116	2440	msedge.exe	87
PID 2440 wrote to memory of 1168	2440	msedge.exe	88
PID 2440 wrote to memory of 1168	2440	msedge.exe	88
PID 2440 wrote to memory of 4552	2440	msedge.exe	89
PID 2440 wrote to memory of 4552	2440	msedge.exe	89
PID 2440 wrote to memory of 4764	2440	msedge.exe	90
PID 2440 wrote to memory of 4552	2440	msedge.exe	89
PID 2440 wrote to memory of 4764	2440	msedge.exe	90
PID 2440 wrote to memory of 4764	2440	msedge.exe	90
PID 2440 wrote to memory of 572	2440	msedge.exe	91
PID 2440 wrote to memory of 1760	2440	msedge.exe	92
PID 2440 wrote to memory of 572	2440	msedge.exe	91
PID 2440 wrote to memory of 572	2440	msedge.exe	91
PID 2440 wrote to memory of 1760	2440	msedge.exe	92
PID 2440 wrote to memory of 1760	2440	msedge.exe	92
PID 2440 wrote to memory of 3208	2440	msedge.exe	95
PID 2440 wrote to memory of 3208	2440	msedge.exe	95
PID 2440 wrote to memory of 3208	2440	msedge.exe	95
PID 2440 wrote to memory of 3328	2440	msedge.exe	98
PID 2440 wrote to memory of 3328	2440	msedge.exe	98
PID 2440 wrote to memory of 3756	2440	msedge.exe	99
PID 2440 wrote to memory of 3756	2440	msedge.exe	99
PID 2440 wrote to memory of 2264	2440	msedge.exe	101
PID 2440 wrote to memory of 4296	2440	msedge.exe	105
PID 2440 wrote to memory of 1496	2440	msedge.exe	106
PID 2440 wrote to memory of 3032	2440	msedge.exe	107
PID 2440 wrote to memory of 556	2440	msedge.exe	114
PID 2440 wrote to memory of 556	2440	msedge.exe	114
PID 2440 wrote to memory of 3856	2440	msedge.exe	115
PID 2440 wrote to memory of 4756	2440	msedge.exe	116
PID 2440 wrote to memory of 4756	2440	msedge.exe	116
PID 2440 wrote to memory of 4408	2440	msedge.exe	117
PID 2440 wrote to memory of 4408	2440	msedge.exe	117
PID 2440 wrote to memory of 1992	2440	msedge.exe	118
PID 2440 wrote to memory of 1992	2440	msedge.exe	118
PID 2440 wrote to memory of 1108	2440	msedge.exe	121
PID 2440 wrote to memory of 1108	2440	msedge.exe	121
PID 2440 wrote to memory of 2904	2440	msedge.exe	124
PID 2440 wrote to memory of 2904	2440	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://bbva.es-empresa-consulta.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7fffc514c188,0x7fffc514c194,0x7fffc514c1a0
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,650061324653930323,216075046735610455,524288 --field-trial-handle=2296,i,17632522018668818903,9348465827610298872,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1856,i,6595712788331813210,18208971806874155887,262144 --field-trial-handle=2296,i,17632522018668818903,9348465827610298872,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,8011919826461286987,231146386214952521,524288 --field-trial-handle=2296,i,17632522018668818903,9348465827610298872,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,631317940534345459,17864959273044125267,2097152 --field-trial-handle=2296,i,17632522018668818903,9348465827610298872,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,17406162821294211895,8730420563134143883,2097152 --field-trial-handle=2296,i,17632522018668818903,9348465827610298872,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,16482109446497906042,5486596312746448652,2097152 --field-trial-handle=2296,i,17632522018668818903,9348465827610298872,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,18444201139022079408,17109125112601585956,2097152 --field-trial-handle=2296,i,17632522018668818903,9348465827610298872,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5108,i,7329241976680685827,17826195309330680521,2097152 --field-trial-handle=2296,i,17632522018668818903,9348465827610298872,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,13635747537891428737,14255119110848291276,524288 --field-trial-handle=2296,i,17632522018668818903,9348465827610298872,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3412,i,5255882147165002940,17634253401852692212,524288 --field-trial-handle=2296,i,17632522018668818903,9348465827610298872,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,13221486222653992513,16131852531524044296,524288 --field-trial-handle=2296,i,17632522018668818903,9348465827610298872,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,13221486222653992513,16131852531524044296,524288 --field-trial-handle=2296,i,17632522018668818903,9348465827610298872,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,11468640619891488787,12719613159525265958,524288 --field-trial-handle=2296,i,17632522018668818903,9348465827610298872,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,11135967518846503348,11657622900169117683,524288 --field-trial-handle=2296,i,17632522018668818903,9348465827610298872,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,14914273281355848317,12817418963142800536,524288 --field-trial-handle=2296,i,17632522018668818903,9348465827610298872,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3372,i,14912607802964217942,16636215154365659575,524288 --field-trial-handle=2296,i,17632522018668818903,9348465827610298872,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5496,i,2963042814264767730,11083762081136937916,262144 --field-trial-handle=2296,i,17632522018668818903,9348465827610298872,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1316,i,5744292963792328818,1805972958594871662,524288 --field-trial-handle=2296,i,17632522018668818903,9348465827610298872,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,5850552965262139193,12221067977028027143,524288 --field-trial-handle=2296,i,17632522018668818903,9348465827610298872,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,16465508725644287510,1633430436126493737,524288 --field-trial-handle=2296,i,17632522018668818903,9348465827610298872,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,638684023158301028,18364870881316842792,524288 --field-trial-handle=2296,i,17632522018668818903,9348465827610298872,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,10512401648610405177,17637890208924484586,524288 --field-trial-handle=2296,i,17632522018668818903,9348465827610298872,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:2904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 0f6e8797ec44866b70bb772777fccc9be92e480a6a74d7167030771d5c750125
MD5 139f17fb31df92791073000f1c84e70d
SHA1 e9e6e51d88d598a0b84044bc548b3e26e257f9e4
SHA512 30f90c4efbe6cb8610346955dea4171a79a315ef2747e4c055a5e807cc34af0e84a2234edf261f8a42231ace03a62a4fa6dc3295b65a412ffec3b262af4e0d9b
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P71:fwUQC5VwBIiElEd2K57P71
TLSH
T10FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b02fb5e58c327d259cc22f4b00c9861bf82dd8a8fcdd75ae54fe56b393c7b3dc
MD5 f0eb336c58ec787e52ee6d776d6c65f2
SHA1 245153e6e7bdbb8f2ab353a836f67bccb89c14c4
SHA512 f55d9b6344c076a10afb3369fc4a8ed0875b79d0f167a2e398228fd523676da0aa84c3d7966a0bd9333c978dfb1bc4bcb1efcc339238b877745fcbe52cf1f8bc
TLSH
T1ECE0208404CCC31DD944E547A354A31CC251B64FD6CAF9463704849531411846AD36FE
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 048ace6a75b96d8bc140f41aa0648b221f9c4c8a84910f5a17ec1aac18086012
MD5 708bced876942dcc036c483179ded0b9
SHA1 58d84ea3bce3e620cbc105c9cf6252d9157fdb13
SHA512 896348a340d81e6552dc5b94c588323d9720e31fac156b94f5535e9e6fa0a084de92707a5b1b158757ac85f7cbcf97ed020938efeed563492548bc798e679716
TLSH
T1E3E0268807DCCE2EDF48A58B56A8530C8290370A96C9F90B2F01C4A830C6250EAC7690
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 03a000b6f473385cb1cc92cc6ed589acc2940878b7cea73f755b1ab9061a9e8d
MD5 530b8f15ea465f2094db1548437e3bb5
SHA1 01663488c4f7d82dd2d8061888cc287c88e83dbb
SHA512 449ffeaae6a3ef57096f501c8fa11b10fc6f834e2d9f9178ef341fed0c4e83cf8695c3d5d8139081a58a37dedf0c1751858b9c15f7bfd5fbc9cc547503ebfb0f
TLSH
T1CB613B09427509B1F32442359CFB4B1B7D7D885F0ADFFE6A22105431EF1AB21052F534
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58be3a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58be3a.TMP
Size 3KB
SHA256 f4bc833f7120252255dbdb0419c748fab6678500b799fd5e36f6eb1b4b22c6a9
MD5 b757e304dfa3ad6832d7286bf769178b
SHA1 49b83f6d92fc53276170380fcbf2d05807153661
SHA512 d12d682ceebb3f06928fe03a798fa1caa87665748eb8aa9fb27bcda179403cb12a43dd2bbd342ca71bc35882f76a1df1e3f37f5ebddb5cbc59723518fff4391c
TLSH
T152612908826609B1F31442349CFB4B2B7D7D889F1AEFFE6A22145431DF1AB61456F534
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c5c907ed819faf0d6b6bdf9f807871bd05b45b2f115312a58e9ac58576183e82
MD5 b970118816d9083b90ecbf9d4f7ee520
SHA1 dd62f5f50140362ff48817498919e203a020ffcc
SHA512 5359475986d437df49133c0ec97570e0dc2fcbbbb29ea18c1835a6a09f36a20ee04c94dbc913abb67b088abe69e087809d949a91da64be03c73003da3cbe47a6
TLSH
T1EA2179FBC6E6C36DE81111F49A246F2BCE2D05944318B86ECDD0AE1F93E2572D042A4A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 62fb150fa8f9bf7bfb473c86941ee7740a265af913b4dc896b2071d27371e809
MD5 e47c47901ffb3227f5a55f96c1aeb801
SHA1 f1c73bdbf442f45529e975e87191d045d022c2eb
SHA512 b6d5172dc262124b929cab24f1b0a3b14bb36f1e7d84535ae1c939eb9324d7a510cb51cc87cc34e366ad35e2277511b1751ff608fd21776878e2ad7aa340bfdb
TLSH
T18431CBB7C6D9C36DD85102F4AA242F2BCE2D0A9443287C1ACDD4EE2F93E1572D102A4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a38b19ff0f5613a6b2c24661f3666b62668aebdb5086a9626deda0a667dd7701
MD5 28b6539a28299c4db76c9489cf3b0c5f
SHA1 56a5b7611715c56a60d5da12ae272fdd19a5f83a
SHA512 9d9c19d134b838b80b1403dbf260264fe5de4ada555c5b50a044415026b415aa20cf4e9830ee549d44827e01b6895da31172fa785efb093606cc3d4d944c55f1
SSDEEP 192:sxZD/ywFaKOMl8Mkc/f3sN5iIupm7HW6+WNC6a/YHfZ46IgrJ:sxZDXMc/f3sN5ycHb2/y9
TLSH
T1FF42E9156B38AD778CCFD209F9557B63D6F90473A1A00E44A9FC9A1C05E6AEC2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4fe58dfeb356db83fab16ed2f20b65babe8ca412c5eae55079dfc72db126a51d
MD5 e807202aaeafc257e99586472259881a
SHA1 6ede9bc104c9a15715c6d8f3e2564e5aae625f75
SHA512 8e2312d4b5668d6f2d605864b7adbe9255d82606046263892f67f14b2f6f7276b85697f09efa5b4231fe1a1db5f777d27cfa1233ec2e24c721b842986eb7dd73
SSDEEP 192:sxZD/ywFaKOMl8UQokc/f3sfaiIupEPHW6+WNC6a/YHH0u6Ig5qJ:sxZDXqLc/f3sfaymHb2/5Y
TLSH
T12052E816AA386D778CDFD209B9557B63E2F9047391A00E4469FCDA1C05E7AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6a922dfee2b2cf53097e78335806aaf02433f4756763ed55f619825f4bea48af
MD5 5685b616bf6cffda1432c12feb3cd456
SHA1 68f6a7cde28e488cddaf34dbb829ed3a76b47123
SHA512 0d24396e6d60889adc653d9302cbb15598ec842c59610b3c69530bc3fe6c3dcda7fb06b840488c5e138b37f6d3763704e163b5cf95555960fab920864699431c
SSDEEP 768:FYUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OV1eLlPZ4RsroVU0jq:FYUZYTMWvg0Pou1jaQeLZmR35jq
TLSH
T1A4D20A2F280CCB7E4F844E9DEC266F963ED801CB5A984D5447EA884C03C76EF512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 2KB
SHA256 16c694209e5710f7557688a9db3b2f85f37194a1fa2424ffcf34865fcd0815c2
MD5 b3259a927f30a8719396c1214daebeef
SHA1 5312dba80715a954eabd27699065fe5d79cc4b72
SHA512 dac80e536d1b2f3247acf4aaec710ebfec95e1dc053b836d63b45f9983c2601b5f2cfb26892df601fbd87115fcf70cb7864e3cf4cf151a43909475bfedab0d1d
TLSH
T14651DA4F4E624A6EE8AC02B214F364D033759CCC1B41D6276CEC2132BD476292D1A3EE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d0562.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe5d0562.TMP
Size 2KB
SHA256 934f195022a947eece372802ab6c6a1fe15200a7ba567eba7dc7fb0431817288
MD5 e0c0eb0efbf7dd0f76f344c31eaa48e2
SHA1 bacb4d3eb0bcd853e4673822182845f657e9f47f
SHA512 2c2e8324669a68253ccf8e1458c8d9f1fd037a09e58924458a1ba95b2423395074910ca21830c5e4c2daedc66b5de4c93f1cbc6f1a35301835a8acf0a601a286
TLSH
T15751649A4D824639E8D4417709E3A8A437392900CA19BF5374FC9636AC927AE3D4E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 67a83f33045b2ec7dc73a97976498d80aa9d9d21ac0b4ce97fcf2f4ed2da233e
MD5 a249fcf8ccb49553b05e05b1a4e09450
SHA1 87e0d69da44820f3eaf2f3c66d4b54a63b341838
SHA512 310656c10798b6847dfe24cc293062d22d8fec1f0c0f3b65137739e281322ace7dc267db92713bee5ecd4000d7993200d54b9cb06f6867fe3696fee569d3ac17
TLSH
T11DE0C0F73DFB1820AD7FC3D74471A4A401017CB8C68CAD8E00AEB2A310B23002806C32
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 016987e23e083eb3fcc405f803c52b978dec8ce0ec40ebcb54d45340f854486a
MD5 b37fd432a2e0860cdc825fd5bb71a2a9
SHA1 ca4123077115a2df0a28503af5b0cb17a3bcf336
SHA512 4f88568e71c246abf1c81da67da95d8328e83480beeaae64e1b00f70bb4aad9c16da555917c95861c17249db4380682cc13eb2fa7af548ccd4c57085d4fc0710
SSDEEP 96:KA1eK2A9zctRL1FF6p24IJFKQ0IbF0TrOpl+u/GKgQbTWKok6aqoKji7:E2X95dXc
TLSH
T1B3D1511330BB12423C3E6A098695973A5A4275B33478E56B7BB900B54E6BF640FFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7e8fbb7134361b206e3c15031046fc61d66556d7eaa769c5ecccdda7b098c806
MD5 1257586c90a41614571efd6ef181083b
SHA1 24bae5c68e9b671d42cd252247c71057b74b50f0
SHA512 071816ad9aa78285af2afa5c95940a204c0ffb7e85fbb216194820e92c3b371cb063fe3cb51b03944acbd0b2aec224d210c92b5ae739f7a6d8949306132fe493
SSDEEP 384:4ZcIhsN90mTlUzX5od+yObJfd+PWV6HlytEDq1U:GhOMO3OF1KOoy6Dqm
TLSH
T1A5927D3159385D33AAFBF545F84B36139EF84027E6986FD491EC6B1C05DB6A8230EC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 2005150a00bf19b0383949fb9300b464e004e7ef86addbc90f697891ab58d98a
MD5 2d9394f71f0e09a793311fafae9317f0
SHA1 fd03c0d77dcf2991226a58270847984afe7f6974
SHA512 4a1291bb85ae48b3f7d71930188ccc81fce8a0f859a66a53a4c2e6e016523a5376b8a4ce0c22a06bbd5334bfce989f95d4c3ecc3ac0d583896ce1d1c5a0a5be3
SSDEEP 384:YZcIkzsN9BmTwUzX5od+yObJfd+fWV6HlytEDq1U:mY6MO3OF1EOoy6Dqm
TLSH
T1CFC219F154E75832D9AEA307A77E3D125EBCC013B6845A8473EC661CCD865BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 132e246efbc1e7d6e6f804f96f214272f40bd63fc3d0b2d96c4a92277a8d80d0
MD5 dd3ddc92e26562faa001ae2be3819f50
SHA1 db417dd05b5a9a3b9274d03de7c0e056219974d2
SHA512 92577846e91b25fb17152284934f7b50f2ce9ac4630b1ab016883085ff5ee2f53aace9ad4cfc29fa4f2a0f8837a440af47ec08d983ed7f7640ec44c9e997e96c
SSDEEP 384:8ZcIhsN9BmTlUzX5od+yObJfd+PWV6HlytEDq1U:qhjMO3OF1KOoy6Dqm
TLSH
T17D927D3158385D33AAFBF545F84736139EF84027E6986FD491EC6B1D05DB6A8230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7245ddfe5170e915154510f2a37f76686011de89d29231561077605dc4cdd56e
MD5 36177f98de72e3ec2594ca06ac951159
SHA1 22afac1fda20417850c74a764f55ed4aeb316d28
SHA512 e5a5a686dd17fb687ad65c6eacd46ee953ec4f11867c4270b0999e4c93b011d13bcb58ca7870135fd3bceb32778a0b172bbaf856430be003ac8224fa5a266ce7
SSDEEP 192:yONx61VWQmiUyP6gGX5Obd+j2Oba/aN3jI1U6:yONx6WbgGX5od+yObh5mU6
TLSH
T11902D835A9686C77DEE2AE49F48737235FE4206BE9546F80D6EC2B1C00D765C234AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f01d6f29c3087378ed9cdac4ec0b7d99330cb8d8a36ac3b5af7845f4bebd1e5b
MD5 a2c87f957d6c8d057bf85c47533e5fb4
SHA1 01a93598bb42dbe3ef0b72148fcd0605c8e1faeb
SHA512 46bc64151422f4c5200ca7636f8352eb615eaae4abda75ad268666b586ed12dc400dea93254aa32467c36fa414d5925f7946b409612b5780f967ec766f9f36fb
SSDEEP 192:wONQ61hWQmiUyY60GX5Obd+j2ObJxFd+3DjJRrqpVU6:wONQ6WW0GX5od+yObJfd+BWVU6
TLSH
T1CC12F932A968AC779DE2A554F4873213AEE55167EA487FC091EC3B1C01DF69C234EC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e208ba5f485ffd95ad94aded028f8a96c14aac8680b4a985ff011a9cf3b68def
MD5 c62ccf71c11d1ba3fa3f95c990582e5c
SHA1 0254ea666358753f6bf779b5c1b8c320c994ce32
SHA512 ca1afcfe868e25547b4adc8004e006b475967245e57bd04c48d72b6b2668341116ff808cfb40d509a87cb1be4fc3e67d658b4ab5b8bdc03cfe98237dfd514800
TLSH
T1D8413959B6F91148B3B37F5A9BF6A86D447EBD332E0AD09E10100E4E0A76A00C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download