a3587c41b5d00545d38c9f9d991831c4ab83ffe699d6b1454b59c06f99452f5b

Resubmissions

25/08/2026, 06:22

260825-g4vxeagb473

25/08/2026, 03:16

260825-dsngeaej5s4

25/08/2026, 02:48

260825-dagadassbv3

Analysis

max time kernel
898s
max time network
901s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MoMask.html
Size 33KB
Sample260825-dagadassbv
SHA256 a3587c41b5d00545d38c9f9d991831c4ab83ffe699d6b1454b59c06f99452f5b
MD5 486f62f2701f4075f5b07b035e92db89
SHA1 0748c63fe825235e5c570786b89c39f93f7df209
SHA512 20b0bd45797d4f26193e6e7bfee49f12f8d8fbbf2b0d18c978dc62d6952879e801c0b2a76df0b892fbddf028d5b9804b60e985b42ab7a6c5726f2626343c6ecf
SSDEEP 384:u+95UPZz7rJw7UvBRyzQA6jqAeFXD/OcR7nj+WUF+/:uS5UPZukBRyMPqA6Tn6w/
TLSH
T17AF2D4755075827F412FF381A0B0AB4AB1BBDB5BE3DF43F1EE9B141525B4898AC0B094
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4400	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320997055751189"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{AF27045D-AD6C-4DB5-AE72-EAACF795DD08}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5408	msedge.exe
5408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 4104	3416	msedge.exe	88
PID 3416 wrote to memory of 5460	3416	msedge.exe	90
PID 3416 wrote to memory of 4400	3416	msedge.exe	92
PID 3416 wrote to memory of 5460	3416	msedge.exe	90
PID 3416 wrote to memory of 5460	3416	msedge.exe	90
PID 3416 wrote to memory of 4312	3416	msedge.exe	93
PID 3416 wrote to memory of 4312	3416	msedge.exe	93
PID 3416 wrote to memory of 3220	3416	msedge.exe	94
PID 3416 wrote to memory of 1604	3416	msedge.exe	95
PID 3416 wrote to memory of 3220	3416	msedge.exe	94
PID 3416 wrote to memory of 3220	3416	msedge.exe	94
PID 3416 wrote to memory of 1604	3416	msedge.exe	95
PID 3416 wrote to memory of 1604	3416	msedge.exe	95
PID 3416 wrote to memory of 5820	3416	msedge.exe	96
PID 3416 wrote to memory of 5820	3416	msedge.exe	96
PID 3416 wrote to memory of 5820	3416	msedge.exe	96
PID 3416 wrote to memory of 5864	3416	msedge.exe	97
PID 3416 wrote to memory of 5864	3416	msedge.exe	97
PID 3416 wrote to memory of 5864	3416	msedge.exe	97
PID 3416 wrote to memory of 2336	3416	msedge.exe	98
PID 3416 wrote to memory of 2336	3416	msedge.exe	98
PID 3416 wrote to memory of 2336	3416	msedge.exe	98
PID 3416 wrote to memory of 464	3416	msedge.exe	100
PID 3416 wrote to memory of 464	3416	msedge.exe	100
PID 3416 wrote to memory of 5808	3416	msedge.exe	101
PID 3416 wrote to memory of 5808	3416	msedge.exe	101
PID 3416 wrote to memory of 3724	3416	msedge.exe	103
PID 3416 wrote to memory of 2848	3416	msedge.exe	107
PID 3416 wrote to memory of 5076	3416	msedge.exe	108
PID 3416 wrote to memory of 4848	3416	msedge.exe	109
PID 3416 wrote to memory of 4708	3416	msedge.exe	110
PID 3416 wrote to memory of 4708	3416	msedge.exe	110
PID 3416 wrote to memory of 5408	3416	msedge.exe	112
PID 3416 wrote to memory of 1812	3416	msedge.exe	113
PID 3416 wrote to memory of 1812	3416	msedge.exe	113
PID 3416 wrote to memory of 4988	3416	msedge.exe	114
PID 3416 wrote to memory of 4988	3416	msedge.exe	114
PID 3416 wrote to memory of 2356	3416	msedge.exe	115
PID 3416 wrote to memory of 2356	3416	msedge.exe	115
PID 3416 wrote to memory of 2128	3416	msedge.exe	116
PID 3416 wrote to memory of 2128	3416	msedge.exe	116
PID 3416 wrote to memory of 3860	3416	msedge.exe	121
PID 3416 wrote to memory of 3860	3416	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\MoMask.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x264,0x268,0x234,0x328,0x7ffa6498c188,0x7ffa6498c194,0x7ffa6498c1a0
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,11268913238627372994,12082560798724477684,262144 --field-trial-handle=1984,i,12551280649268527372,474302014518656075,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,6876764862493315021,12583654410635157430,524288 --field-trial-handle=1984,i,12551280649268527372,474302014518656075,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,4919915455284098699,15206313474620581989,524288 --field-trial-handle=1984,i,12551280649268527372,474302014518656075,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:13
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,12090120713621053839,15911356024545576747,2097152 --field-trial-handle=1984,i,12551280649268527372,474302014518656075,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,2705789541358701920,11908827022588363336,2097152 --field-trial-handle=1984,i,12551280649268527372,474302014518656075,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,1683887317427393234,17034902015973544308,2097152 --field-trial-handle=1984,i,12551280649268527372,474302014518656075,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,13000533343776159266,2153289665819652364,2097152 --field-trial-handle=1984,i,12551280649268527372,474302014518656075,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:9
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4396,i,6609728128095628015,3906554363456009308,2097152 --field-trial-handle=1984,i,12551280649268527372,474302014518656075,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,7142761184597320067,5226979963492930259,524288 --field-trial-handle=1984,i,12551280649268527372,474302014518656075,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,9240308552443257478,6326958077923495763,524288 --field-trial-handle=1984,i,12551280649268527372,474302014518656075,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,11371023448172757063,10339882090889915111,524288 --field-trial-handle=1984,i,12551280649268527372,474302014518656075,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,11371023448172757063,10339882090889915111,524288 --field-trial-handle=1984,i,12551280649268527372,474302014518656075,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,1668727781023904451,14179312318840370060,524288 --field-trial-handle=1984,i,12551280649268527372,474302014518656075,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,1032310387105805668,10656099896245702974,524288 --field-trial-handle=1984,i,12551280649268527372,474302014518656075,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,14036858687334764840,847593212410820167,524288 --field-trial-handle=1984,i,12551280649268527372,474302014518656075,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,14577340329613067642,15950408645380257130,524288 --field-trial-handle=1984,i,12551280649268527372,474302014518656075,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6676,i,17360789875895608,14885546174780186982,262144 --field-trial-handle=1984,i,12551280649268527372,474302014518656075,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3880,i,16673466238780229237,5679862835599242922,524288 --field-trial-handle=1984,i,12551280649268527372,474302014518656075,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:14
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,9762093184235818167,5263095420349051595,524288 --field-trial-handle=1984,i,12551280649268527372,474302014518656075,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,3055648489359034876,14302499504162071155,524288 --field-trial-handle=1984,i,12551280649268527372,474302014518656075,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,16196232837828368519,14416470767297849532,524288 --field-trial-handle=1984,i,12551280649268527372,474302014518656075,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:14
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,13228366696995840703,6753871722864463890,524288 --field-trial-handle=1984,i,12551280649268527372,474302014518656075,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:14
  2⤵
  PID:3860

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5184

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

0fc59c4f-0e46-4519-9d58-79921872937d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0fc59c4f-0e46-4519-9d58-79921872937d.tmp
Size 27KB
SHA256 14528373e32df208c7e5bfec67461d357bda2c15c5227b0fb64cbd05bb0eab39
MD5 08f8a383ce8fd6966e2e7170525205da
SHA1 38d8a6b88e9e2e8021e5774d6b514f234a1ba07a
SHA512 c9de27e381fd002c38ddf6d8f1a5531d665979cb35d7a670ed03c49db9502afb02eaab82d3293686944f5849a38bc4a73db5edcbad53498146fa7f1ecfd2d15f
SSDEEP 768:j/8vrQWgQ+fB+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCQqqQrovi:j/8vrQWgQ+fB+u1ja3Vq7a
TLSH
T1E7C2EB2B640CCB7E4F844EADEC29BED66DD801CF5B588D5447EA890C03C67EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 ce2a2bab29149d5f390b2699c7fe35ca5e36fa05884033038dda870b0edfe067
MD5 4bf13e6673dc7e9d2607dfa817269a8b
SHA1 177a97498ec9736943b73714e90b69eba9e29f4b
SHA512 58a3135a4b54ecb0013e9483720c3af1d6be5937d1895cb6dc994a24f4c424205bb947baef59d084faf6ced25cac816cd218edc043a1ed34332163492c6bdff4
TLSH
T1F6E020D70FC7C35DB688A88753B4534D91813A1AD2C4B91717008D4C7043454E693990
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 8460cbb4390df65c777547425bae67d6817148b984e6bf499250b6ee1e126fc9
MD5 89b915d0a23709a4a0e388b91f2a9241
SHA1 d44a61d57b7b7fe188c7f1aaf9cc7b7b2fa41a53
SHA512 e9d94c21fb03f886db2a1df988237a429a2542200d9136f1e5b5cb7299818fe3ce9ae70da46bc6d05c7bd93a938aa9732f250caf7c2f57a9830ea1bc2fbc7f88
TLSH
T1E6E07DBA1ED8C22EA640748793FC734D82C03A0AD3C8FD0A9F0088CD7086444FBD2B90
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 0d294e536dfb3ccbd8467764225f5ca5cfffc4df8347746f88eae715ec260763
MD5 8781c3df87ce5b73775818fba939caed
SHA1 6c90859b58aac22864cc7fa5f048b6f5b15a32d4
SHA512 f4591b0886966f7165a90c2213b8ef68ee7ede506eea5b26522a05c8fc1efff7250e9c0019e7bab88e088646c402d376e2eb2df3bf8f83c4f31ef8b5d1622c17
TLSH
T111E07DE50AE8C23EEE806C87536853CCC2803B0FDAC8E91A1700A8CD7082444B2DEB90
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 876960c70dbae5c2aec352a10c5e334101cdac7b2a1525d57c45af039e3fad31
MD5 b488c84e3a6e7b969ef970090b57368e
SHA1 84c084304de16781f9bcb4703df3690d38d9148e
SHA512 e104e6eb531084f0f2d2338737356a8494998e328aacb7afff027da4ca008c65d37a50165fdc8ad2a4587242fb14e75c2b6f4c5feeb6aba19d9b8d7f59cae73c
TLSH
T102618C9D43EB29C1C795ABB15CF0A09AF2718C96278BAE77BCD49770E712324D394482
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 cccef979ea6f3d5644c2b066dcca3abaee55061086793835e0cfe7b2c8aafa6e
MD5 4ef208cc7cd8ccceca921823586ca819
SHA1 e3f100534aba4e7f9a431372fb887de5330adea2
SHA512 6db8bd759495f62064cc2c1d6b3226aa81286ed3c07ac469764fb4dcd959c480c3a15cb11add3caeedc9219aaa76705c1dd47311880c3c086117a8289a464222
TLSH
T1BF51405D43EB29C1D7A4AB72ACF091DBF2718C8A2787AE3738D4A1749B12324D394091
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 18e48d39458fe2504d6df2f6561f0ce5db26042de535fd78cf948c83dc494ee7
MD5 08ff535fa55a886f301ce315b8fd2e33
SHA1 4003a346b480d143652d01d78cdc3fabc8bc0cb9
SHA512 88f8e6cea3875c1f4e0ec76bb83bad9e3e173b621009b729d47403e49271981f78159a88dfac3f290fc76a9afc0414cee515ce77b11c28a4dd6d7cc6dadc6633
TLSH
T10971ADFB83B447BE991192F0AA25AE1BCD5D1017036C7CA64AF46E0B63F24B1D14279F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d0399854cb6b4e5d195122a4f5f62e8fd5aa2c13f5e735cfe15aee2196cb5b68
MD5 f14bc59bd511bc01939e367de5c3d5fb
SHA1 22e57b0f4bc84d8971f1e4d5614e8d457281a523
SHA512 c5d6abd92805006c40843322f75b12a57a71dd487c301e77264956421a386d07d564c851f6a0a6d872b57c0dbbc8466ccaa7cec1525cf2201fef5b5f3cdc11c5
TLSH
T16781AEFB83E4477E891192F0AA256E1BCD5D1517032C3C5689F8AE0F63F24B1D14269F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 42bb4f7fce047945b201140fcc9582bf26f86cedfa377fb930b25dd3780c83fb
MD5 2b57e37c14739ff3f281bff57110ef5b
SHA1 21ccbcf5f1ac96fb53479b2acb92791632de1b06
SHA512 912f47116c9ef892d3a554b48f4d2e9d1aa1705907b6a7d3ea68f3e9fadba3976245bcabb18ef64c905b520ccacbb4b78147ccb934e5bac7663a55994725e92e
SSDEEP 192:sxR//ywF6KOMl8wbM/f0sP+VDde5lSJFzoA8p4C/g6+WNIYCN/uOKgGOIgD7J:sxR/blM/f0smVc5lvv/5IBTB
TLSH
T16F52FB159A286D7BCCDBD20DFA557F93D6F81533A1901E44AAFC9A1C04EA7EC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 98b4cc127b11ca551bdb8ced8cda81021d9e5d271df94c494625d3895b67bb33
MD5 9315124bc66dab124e4e427937ccc152
SHA1 926ce69c2a7c78f882925f11bb40aa6a7a68dbf7
SHA512 99188ef20c52c8fcd2d86422a374f28a9427728d7a63cae6e50888d565213cf411c0d4b42aa77a4b5a62a11d6b8eaa3ec26084448ca254be7b9471a4b841f1d4
SSDEEP 192:sxRg/ywF6KOMl8wbM/f0sE+VDde5lSJFzoA8p4C/g6+WNIYCN/uOKgGOIgIJ:sxRgblM/f0stVc5lvv/5IBTs
TLSH
T10252EA159A286D7BCCDBD20DFA557F53D6F81533A1901E44AAFC9A1C04EA7EC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2f3976babdfe5cc36933a94a551c0fd8cecdf43f001057c169d6c7c81935491e
MD5 52a37b341201e681ee1bd900f83cbea5
SHA1 cc80af9f32fe588d233f487b690d06be02996c02
SHA512 586aa47383ee6e403d7a95561169b72a034da9eb819a705d386ef6589eb543e32307571a89784df87ee5d9029c7f1bd4a195b1c5e212be993e9a259d4425273a
SSDEEP 192:sxR//ywF6KOMl8UQVbM/f0sP+PDde5lSJFzoA8peC/g6+WNIYC3JVuOKgGOIgDNJ:sxR/bqNM/f0smPc5lvR/5IFtTr
TLSH
T1C462D9159A286D7BCCDBD20DFA517F93D2F81433A1901E44AAFC9A1C00EA7ED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8501c937-c5c8-47ed-b42c-68f4ecb0579d\index-dir\the-real-index
Size 120B
SHA256 53e4a5c630dc9b2c5c78592ef32be19da9fdfcf5fa9d4a7fafd05b898461351d
MD5 b1631199928909f9f39d11317735c132
SHA1 b05fde1bd47140652f3d2f934ac3a8966372f9f8
SHA512 f623f33d10a77c4b9abb7037805fe2ece9aba21e46c4bf33a33348db390410666457b2969eac7c229098716e234c30555999277c06013c7feca82f0b178a4c00
TLSH
T1FBB012098C490861CD070571097723983B3707EC1B110B3310FC1017A5A10AE8516540
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ec6f7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8501c937-c5c8-47ed-b42c-68f4ecb0579d\index-dir\the-real-index~RFe5ec6f7.TMP
Size 120B
SHA256 c48ba92fa63d527620f58d9eb91c16e1d2b63982c150f8a9079d98dc5d05d3f9
MD5 383458ed7816e3b932dfe6a234ed246d
SHA1 8f72ca7e2f5aa8e67eb9eb2dce1a0ae18340eac5
SHA512 511514da080e4e7732b1a11c1c571248052b5a3d0098219824862bf9a5ae23c082cfafb3e7bbbb01c18effa7d124549bf0ec893c3e172ca880d8f161a09f15b4
TLSH
T1FCB0123A51800C70DC0A01701413920833770C141960473320D9049B49720C84541404
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 5f3441255b8e5ce03e50e5ab85395b368cba466b027614e5e7edcf5ab36ccd91
MD5 fbfceb2ab9e7337ca1009585d0baa699
SHA1 43406777a07e0cdec30657c09b401e816474b410
SHA512 1cc8fff390e8b1763c7a971c2132208213eb221a82f34043fbd3c79473a1eec6086ab29a07f88a60c8b83ef4eb21aba1fedff164f22fe2f8a83c1b205dd6d1fe
TLSH
T110E0207B3EA72C20FC6F97D9147054AC040578E8C949ED4F546BE5C764B23563406D33
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1de6722a87a1fe79a958841795e646b6fb6171d65a4cca0c15ae9557013401e8
MD5 9574b52875aa0f01a71fa552269ad8e2
SHA1 2ca48f77f001b31288608aad2b899fd58f1fbffc
SHA512 c0f40e8534bd55ee774188831f78d4c7871bc0788b0204d656c39af473777d008f96fb454f1822a4d04d365b4524cb6797d99e3e0afbcb6980b93cbd82a0ebee
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHgRkQiOCYWm7LgYYK49gKYcY4rKQ16UAKp:CbEBVj5JAdSp9/EgTK7j6dJOHgRkQiO2
TLSH
T19A916A00337E0640797E650CC5B98969968570B33419FA3B3BAC015B2FABE465DFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 e7dfcd2af3cefc7ce57f7bf6991d35a5d20958cb42766f953d9e1c76fae333b6
MD5 5cb2b7e81b4702abd9866dd283d10b96
SHA1 5384d524ca48437435a367dbbc158070ce70493b
SHA512 c5558f99f45f9b2e4cc7c7fd80211556401a16d808a8b34aaccf6cba23f5b5a5e834235a19cf251015bda0baa50c8bea1b0a20624e7e483f5a039e0d86134f85
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uQ:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAZ
TLSH
T168A2B81DC81C7E3257CA2F7D6A2F9DB276CA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5b2027.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5b2027.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 8834a85c68cc773637c9df31f17ba364f4911604c8d370e7cb4965787ca7f30f
MD5 5a8cf3f9eeca2fb0c1f02625090fcd16
SHA1 a04fd4707f5f24dfecd6e975cb1aaf446928e903
SHA512 d6c730afd85f5cd53cd74aec3156577b7175fb09eebaa25976a4ed3c3414371213b7b81653bd84c8d0b4950f8b14543d9beb09aeae47864d3966a41b6272737e
SSDEEP 768:hrv+4UNbdB3muID0rp8+p3bd66j+4BRv86aLIW+fp:hbsb73muZN8+p3Z6n4yMfp
TLSH
T1DF03BF72F8A8AD338CF2C644F14A7A43BFB8115396C40DE4D8DD6B5D119A0AE230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 2ba09df31dda3117fb5c2be810cf4ff97860a388ce06b2d4f2aba454ce3b6cd4
MD5 da95071fe024e80eff4d49cd7f217833
SHA1 3773d12d68b9c953e44dffe92fd5316447180c63
SHA512 639ea40ff588b178010655634429366ede80d9db60fe29b11f463807513bfe289fc59f6ee39b77ee9106f4dc84e17236f0274b5c2fc78bf53eb0e074c5182b4a
SSDEEP 768:UF0rv+4UNbdR3GwgKucDdp8+p3bd66j+4BRv86aLIW+fp:BbsbT3/uO8+p3Z6n4yMfp
TLSH
T1CA13AE73E898D9379CF6CB84F24A7A43BFF400A385C059E4E5DD6A5D119A0ED230BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 353dd38b6292118d5c86a0f58328aebd27501af928d85f1673ce008baca69754
MD5 080ec17fd979926607101b4d70e388a4
SHA1 cef810fa1b38138f9aaaf69a86a707addff1e6a5
SHA512 75a39a71119ea1e96620f7c97453333de3f5512ecc0e369eecae4713269a0bfeefbe1669b329b419cca177f50bf9cab185174439df7eace245da125584090e0f
SSDEEP 768:UFQK3iwgZucD2p8+p3bd66j+4BRv86aLIW+fq6:3K3+ut8+p3Z6n4yMfq6
TLSH
T135F29D72D898DD779CF9CB84F64A3603AFF40163C6C459E0D9DDAA1D119A0AD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 8d268a73f9bcf1cb8326d6efd2a8349b7c287c9f892a67bcc1d0fa5abe2f77c8
MD5 0242562726ab082c5617620168d15403
SHA1 8689066948154bd0fa4525339b6e513d046b0537
SHA512 1ccd3b263de77fa93dd7f6720fd5586b969b658eda854de9cb2357d3053d0af7bfb1af3d2fdfc83ee850f7ae1da72d25c0fd1a80a393b9728db63058e1921e72
SSDEEP 768:4rv+4UNbdB3FucD0rp8+p3bd66j+4BRv86aLIW+fp:4bsb73FudN8+p3Z6n4yMfp
TLSH
T16503BF72F8A8AD338CF6C644F14A7A43BFB8115396C40DE4D8DD6B5D119A0AE230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3d543aec80098c92e6694c60d879e421e891ebf74861275a45693d41cfc6f552
MD5 47f941afc8886e362699590313fcc300
SHA1 cbe90367bd176ed275773528dc35612f670106fd
SHA512 67d3a68c99a7f5be3c3dfe0f012cc7db9ada359ed807d148490e82ebb673638b6b19928dcb722c3134c981ffa0979f586f28f7abb912504eb2d3253238c6dd18
SSDEEP 768:Irv+4UNbdD3QbcdNp8+p3bd66j+4BRv86aLIiP2bwCl1:Ibsbp3lL8+p3Z6n4yJ0ww
TLSH
T1F203BE73F8A899339CE6C644B2467B437FF851A396C10AC4D4DD2B4E419A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 d5d627bccdb372a8daae8d31c006b9fc457cf580005ea0a6739dd24730bc8b13
MD5 3bd57c31868d6157d141bfa77d5dce25
SHA1 8292e771807937f635e25fbbaa5f21825aaf40a5
SHA512 aaff43ba80c60718a8b52e1bf96ebe32899d7680c1ec519e3fac5450a7e7dc98b00db0e08b33543eedeb2f250b711267693a12a1ea4b44cacb372c5bdc37eb5f
SSDEEP 768:orv+4UNbdD3sd0Np8+p3bd66j+4BRv86aLIT+2bwCl1:obsbp3vL8+p3Z6n4y30ww
TLSH
T10203BF73E9A8A9339CF6C644B1467A437FF8519396C10ED0D8DD2B4E019A1AE630FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download