7c2ae9770354535e263807f52a067f28fe8eb0b23ef0b498f5ec885dddca9396

Analysis

user interaction
yes
max time kernel
50s
max time network
51s
platform
windows11-21h2_x64
resource
win11-20260513-es
resource tags

arch:x64arch:x86image:win11-20260513-eslocale:es-esos:windows11-21h2-x64systemwindows
submitted
31/08/2026, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Seja o homem que você quer ser.eml
Size 306KB
Sample260831-gpf5pseh47
SHA256 7c2ae9770354535e263807f52a067f28fe8eb0b23ef0b498f5ec885dddca9396
MD5 7336da2358287c2ad9b5fd38366505e3
SHA1 64eb15b3369bf13f4fe78338aa7f98bd0e6606a3
SHA512 f147006bd10b547d4d135c2264927fb919fab7f8a298024572dc63edfc0fe785f8c3f60c3ddf03e86e13433da0ce6f01a6ebaa2021a8fcb89e3a82494803ae31
SSDEEP 6144:FTkzeEiTfFRywLPX7MT1XL7tLLQR10UAVebK29quWl7L01S1cSaaW2cX:FTkzeEoXrMp75LIv24rS4S1tW2S
TLSH
T1596402189B6B5E578B7250E67417FD47F2D03C43645202E022BC9BF779C92888F5B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2076	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326295456544597"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2043432456-1617298091-2772621413-1000\{39DD0AD5-82AC-4EEE-8E2E-723FEE334D24}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2680	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 30 IoCs

pid	Process
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE
2680	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 3032	2680	OUTLOOK.EXE	81
PID 3032 wrote to memory of 5044	3032	msedge.exe	82
PID 3032 wrote to memory of 2076	3032	msedge.exe	83
PID 3032 wrote to memory of 1288	3032	msedge.exe	86
PID 3032 wrote to memory of 1288	3032	msedge.exe	86
PID 3032 wrote to memory of 776	3032	msedge.exe	84
PID 3032 wrote to memory of 776	3032	msedge.exe	84
PID 3032 wrote to memory of 776	3032	msedge.exe	84
PID 3032 wrote to memory of 1528	3032	msedge.exe	87
PID 3032 wrote to memory of 1528	3032	msedge.exe	87
PID 3032 wrote to memory of 1528	3032	msedge.exe	87
PID 3032 wrote to memory of 4912	3032	msedge.exe	88
PID 3032 wrote to memory of 4912	3032	msedge.exe	88
PID 3032 wrote to memory of 4912	3032	msedge.exe	88
PID 3032 wrote to memory of 4800	3032	msedge.exe	89
PID 3032 wrote to memory of 4800	3032	msedge.exe	89
PID 3032 wrote to memory of 4800	3032	msedge.exe	89
PID 3032 wrote to memory of 2228	3032	msedge.exe	90
PID 3032 wrote to memory of 4032	3032	msedge.exe	91
PID 3032 wrote to memory of 2228	3032	msedge.exe	90
PID 3032 wrote to memory of 2228	3032	msedge.exe	90
PID 3032 wrote to memory of 4032	3032	msedge.exe	91
PID 3032 wrote to memory of 4032	3032	msedge.exe	91
PID 3032 wrote to memory of 2808	3032	msedge.exe	92
PID 3032 wrote to memory of 2808	3032	msedge.exe	92
PID 3032 wrote to memory of 2808	3032	msedge.exe	92
PID 3032 wrote to memory of 4608	3032	msedge.exe	93
PID 3032 wrote to memory of 4608	3032	msedge.exe	93
PID 3032 wrote to memory of 2948	3032	msedge.exe	95
PID 3032 wrote to memory of 2948	3032	msedge.exe	95
PID 3032 wrote to memory of 4748	3032	msedge.exe	97
PID 3032 wrote to memory of 2548	3032	msedge.exe	96
PID 3032 wrote to memory of 4748	3032	msedge.exe	97
PID 3032 wrote to memory of 2548	3032	msedge.exe	96
PID 3032 wrote to memory of 4780	3032	msedge.exe	100
PID 3032 wrote to memory of 3868	3032	msedge.exe	99
PID 3868 wrote to memory of 4776	3868	msedge.exe	101
PID 3032 wrote to memory of 4108	3032	msedge.exe	102
PID 3032 wrote to memory of 4108	3032	msedge.exe	102
PID 3032 wrote to memory of 1012	3032	msedge.exe	103
PID 3032 wrote to memory of 1012	3032	msedge.exe	103
PID 3032 wrote to memory of 5064	3032	msedge.exe	104
PID 3032 wrote to memory of 5064	3032	msedge.exe	104
PID 3032 wrote to memory of 1660	3032	msedge.exe	105
PID 3032 wrote to memory of 1660	3032	msedge.exe	105
PID 3032 wrote to memory of 4772	3032	msedge.exe	106
PID 3032 wrote to memory of 4772	3032	msedge.exe	106
PID 3032 wrote to memory of 1708	3032	msedge.exe	107
PID 3032 wrote to memory of 1708	3032	msedge.exe	107
PID 3032 wrote to memory of 1708	3032	msedge.exe	107
PID 3032 wrote to memory of 1572	3032	msedge.exe	108
PID 3032 wrote to memory of 1572	3032	msedge.exe	108
PID 3032 wrote to memory of 1572	3032	msedge.exe	108
PID 3032 wrote to memory of 3368	3032	msedge.exe	109
PID 3032 wrote to memory of 576	3032	msedge.exe	110
PID 3032 wrote to memory of 1764	3032	msedge.exe	111

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\Seja o homem que você quer ser.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://eur05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fg.cavera.click%2Fsupersalelinks7%2F&data=05%7C02%7Cphishing.wizink%40evolutio.com%7C847eb7f751cd49af4b7e08df06d3343d%7Cc7d9add8772749a298b90061453368ef%7C0%7C0%7C639237176335713588%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C20000%7C%7C%7C&sdata=reXym2Vnpa90qgPEN%2B9G0Sb38GblzNDEB53Du0TNVM8%3D&reserved=0
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffe449cc188,0x7ffe449cc194,0x7ffe449cc1a0
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1712,i,3404722986390902522,9965957337130453167,524288 --field-trial-handle=2424,i,12762898918223280541,5243237759069201755,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,7787316030069052203,18167078270942793790,262144 --field-trial-handle=2424,i,12762898918223280541,5243237759069201755,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:2
    3⤵
    PID:776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,4373153455938183660,16744727947836466296,524288 --field-trial-handle=2424,i,12762898918223280541,5243237759069201755,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:13
    3⤵
    PID:1288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,3077415014617591663,11069389181431380340,2097152 --field-trial-handle=2424,i,12762898918223280541,5243237759069201755,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:1528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,16174163779960029397,11915777210186037791,2097152 --field-trial-handle=2424,i,12762898918223280541,5243237759069201755,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:4912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,1124371094116240484,10388788607837533011,2097152 --field-trial-handle=2424,i,12762898918223280541,5243237759069201755,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,8979719257892734056,18407784619079642841,2097152 --field-trial-handle=2424,i,12762898918223280541,5243237759069201755,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:9
    3⤵
    PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4220,i,13373679865720568341,10287182087658795931,2097152 --field-trial-handle=2424,i,12762898918223280541,5243237759069201755,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
    3⤵
    PID:4032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4348,i,9170442482563682238,5772317109597154211,2097152 --field-trial-handle=2424,i,12762898918223280541,5243237759069201755,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:9
    3⤵
    PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,2757064315253227561,939542005161045320,524288 --field-trial-handle=2424,i,12762898918223280541,5243237759069201755,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
    3⤵
    PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,11305791957029039989,72422034170554641,524288 --field-trial-handle=2424,i,12762898918223280541,5243237759069201755,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
    3⤵
    PID:2948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,7027207041606656541,6463561218430670199,524288 --field-trial-handle=2424,i,12762898918223280541,5243237759069201755,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
    3⤵
    PID:2548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,1648190126800139316,10750306649273097679,524288 --field-trial-handle=2424,i,12762898918223280541,5243237759069201755,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,4300464060451041110,11719398877854646131,524288 --field-trial-handle=2424,i,12762898918223280541,5243237759069201755,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
    3⤵
    PID:1012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,2949488287101529413,9075932499243485509,524288 --field-trial-handle=2424,i,12762898918223280541,5243237759069201755,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,4300464060451041110,11719398877854646131,524288 --field-trial-handle=2424,i,12762898918223280541,5243237759069201755,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,5311330963668631878,13349327607471115675,524288 --field-trial-handle=2424,i,12762898918223280541,5243237759069201755,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
    3⤵
    PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,3506594460904316877,9482481922987238022,524288 --field-trial-handle=2424,i,12762898918223280541,5243237759069201755,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
    3⤵
    PID:1012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,17325592817776846737,9654584252679999079,524288 --field-trial-handle=2424,i,12762898918223280541,5243237759069201755,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,5620886656468321062,5578448113512282886,524288 --field-trial-handle=2424,i,12762898918223280541,5243237759069201755,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
    3⤵
    PID:1660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,9698668857903022541,15115096205140902201,524288 --field-trial-handle=2424,i,12762898918223280541,5243237759069201755,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
    3⤵
    PID:4772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4856,i,4351326757522275646,1389071200555135868,2097152 --field-trial-handle=2424,i,12762898918223280541,5243237759069201755,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
    3⤵
    PID:1708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4280,i,3502786543119269494,3494984126623747435,2097152 --field-trial-handle=2424,i,12762898918223280541,5243237759069201755,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
    3⤵
    PID:1572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,5710244859880842162,18322049363013948507,524288 --field-trial-handle=2424,i,12762898918223280541,5243237759069201755,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:14
    3⤵
    PID:3368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,9416201810385853967,10597866842075282002,524288 --field-trial-handle=2424,i,12762898918223280541,5243237759069201755,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
    3⤵
    PID:576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,10761170080939604604,7040248340173543487,524288 --field-trial-handle=2424,i,12762898918223280541,5243237759069201755,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
    3⤵
    PID:1764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9dbdf7ae6ee7a7e9d236d0b7183bc135b93e4993b95711c39398860ffc7d90c5
MD5 c3dcb0f0fef69d9b1e33e0f7b9310656
SHA1 ba30d4e26f155ab4d323ddf8315a60e9544c03aa
SHA512 32375ccc6615e491293a97fd89fdca73e8e7ea410c7ad5a50b20d98db9ad07f419ebfaa4d5b367e805671f9488755014fe16e6f3ac147a14cc8f320f30e6b2e4
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7g:fwUQC5VwBIiElEd2K57P7g
TLSH
T170B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bd4529961b35d0e609d59d8934f31b5750646dc2bc1bf9505bd34d2b18cd8186
MD5 88f2a8648379b534722bc71e9abcc004
SHA1 3f2d541c23360d6466c56939422666cef9feff30
SHA512 559577498aabd6587d053d66ed485c2a085a0548c4fefcb2775944a354c5c9b70dac678be080cd2301fad0010599251363afd3a5f086e0e66db1e8678b2f58ee
TLSH
T1D7D0237001CC3A8AF42F303C70134148714FEF801803A003C801323F0F0759003950F8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 89ab71a3a4e732da8cbbe2e13ba149e13c94226b7119c8a0598106b99907544f
MD5 ca938be236bc251b79a4ee9dbf06dd19
SHA1 2ed95a78846a95a90b8d9b70e9cdc6188f0ce608
SHA512 caf4662a529a373a26b513e285938286f3af46a8729fb4c0be324b084fdba1e10dacca4b8f67585c4a5c6683f45dc7e259548eaf3ffb985905aeefbb7225e0e7
TLSH
T124D0C073050D0000EE0D41312073C7050313BB210E017D03B855F8380D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dcfc4c476f41db2d6042449b7b855b9751140e2127be8e8208aafd46a5893b7d
MD5 08e448ed3ad1512fa216c2eea50fff9a
SHA1 2d684e6af180cff0b8adea283dbb0c009102fc3e
SHA512 f9ebe4d980c84e665fbd9643a31fbc7a6b08028d289cd54ea7400acc1d6a7d231dd7952c9c49775207225efebf00cdaaf6a2b295dbeac8f234ed7bdfa52c4693
TLSH
T122D0C073050D0000EA0D41312073C7050313BB210E013C03B855F8381D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a4a3801be682bfbc6d9e387739e7d55e550119aa976eeb51d7fd93406ccc454b
MD5 5e299c1602278e4c6c1f30ab46444214
SHA1 bdb29fd65b0068b9edc554f3b7aeb696d8c3a3ac
SHA512 72ee618128ed286d408d8e5681b3c74882133adede3392994e19f01bd8e23cc70f536da63a2372db06c193589cbc583c562ae97a371c7f45702d3a19314577f3
TLSH
T10261825BC79644B0F3A7D370C6F31241F4B045EB1B9FFEA19360997AAD0DBA68227504
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e441.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e441.TMP
Size 3KB
SHA256 e05ca6d386039ce2e7af86459715bf746667251e14ab5da73be0717d9bf27e69
MD5 c7393ca8b42fc886f253604c2e8c79c7
SHA1 ee9a1177101e31988d3c5b1d47c002a4bdfd2275
SHA512 405f7694f09fa70533e4e9dd6fd6cdd69f3515a5fe92d14b8429d1eb041e38878f9460199a1697be24d79d9dc8ab0968cbe555dd4d8bc71ab1b45c3e9d83890e
TLSH
T14A61825BC79644B0F367D370C6F31241F4B045EB1B9FFEA29360497AAD0D7A68227104
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 cac457f463116ccddd37b7490859a628b2ec5167c997b5d2bceb593ae0796154
MD5 3f0c54ebb61d0e8234ce7c77a8eab8cd
SHA1 75fa5ec826cb6dd09efcf715420171a0f43d9ffd
SHA512 8f1fb9d37e3cecfb4958c6acd72726c4b3c60ccac0b622889793b8c78fbfae1335095fca0d8af2684076c13a4bb209563e43c84812b787e086feb8c26681285d
SSDEEP 3:MsEllllkEthXllkl2zEklt7eK:/M/xT02znR
TLSH
T19B4404047FFC0415CD001031D135C3540FF0D5151511D7433CD504735CC55500C00010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a183542eabfdc8827cd686b5c86f68f37ddac2611f1d4ff4c93691bc1fefeb5f
MD5 e4b486a928ecd40ba216fb7ca6748ec2
SHA1 cc96ddadb7ad449ed4d70239ba14d03fe2fe4e83
SHA512 954adb4d09710b5145ce92bb8fcc1975601a932f788b3c4c9ad04b1a4375c39962895579177edcf1ca42f4d00748a730261bd9b58e13aa02694fc198e5c78fb4
TLSH
T1ED31B0F7C3E8966D894156F4BA287E1BCE2D0914435C3D9AC8E4EF1B93E2971D24098F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 11b50617112973a928afe92dfc330c4ff9fed6928526b5eddedcf89d3b303858
MD5 e17f6a35b85258098116050d7570cf4f
SHA1 2a1883f6c4c9abcf6c4d500e6a8b2d9e90c00905
SHA512 65a96618f937c0cf87f4e9ecd23657a3a509e5df91f5db7d02f01d60dac6ffb1d7ea2cfd4b02b3df7af63839ef29866af64456349c8dc3ec4590a2e81bcb099d
SSDEEP 192:sxZT/ywFvKOMl8MNB/fJsK0aIEIupM/W6+WNGY01JE18Ig5pJ:sxZTC1B/fJsK0GM/bG5VR
TLSH
T1BF42F715AE34A977CCDBD219F645BB53D6F94472E1800E48AAFCCA1C05E66ED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 070c0e04726e889151798eb7bbf3782761582a88d94cab073bf635b6f9d5565c
MD5 74469000be98868731e8ecc7b4e5f549
SHA1 d11aca62f5addef173610f5a8de73809dd5549bd
SHA512 1808fd4893b8e5eba283c3e5b0e53165ec15efa2d05b3a854997ddc32c7c68393149bb68fbc42f8cd8807a99dd7d86ac682b613f2d689fa4d8908b88ff09b5cb
SSDEEP 192:sxZT/ywFvKOMl8MNB/fJsm0aIEIupM/W6+WNGY01JE18Ig4J:sxZTC1B/fJsm0GM/bG5Vc
TLSH
T1EC42E715AE34A977CCDBD219F6457B53D6F94472E1800E48AAFCCA1C05E66ED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b6e89371262fcc63246a49fdee4c1d241359dd96a16df9c6ed8cb1aae1f67912
MD5 011d58d11d8b4c896046f7f3fdc769bd
SHA1 66f6041e295b2bfe65d86055084de1e12dcb3c1a
SHA512 67f56204ac5d665e4d851021bd2bebe43e028c5c6f0ec9437efebdda829fb3d89d347369900bf354c2f69350e67b930b6c5ec43d8cb2c69b6e7b5d6a5ba62e6c
SSDEEP 192:sxZT/ywFvKOMl8acB/fJs8WpVIxaIpIupwg/W6+WNGY05bidCKrKIgbHJ:sxZTCgB/fJs8WvIxjZ/bG5dsTuF
TLSH
T1BD52E715AA34A97BCCDBD219F6557B53D6F84422A1910E48AAFCCA1C01E76ED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 39667c524d8ae6b29ec26aaa5c88e997ab2b0fba264894661c1852113beab272
MD5 270aa7ee0c9126f32564ac59255d911f
SHA1 8caec7f14ddebd59f3eeb975a6db1483ec3432f0
SHA512 a127e62714539bbc31e6cdff22354ef5c0c56b9291723ff9a5890a27d54b4782cd638aa50429e9e6da0a625a3f5ca55e228219a5765d109c48797e3d5d1aa37d
SSDEEP 768:/U4bSV4b+8b4bm2oN7pLILtG4bRWRmG4b/QB4bH8F1+UoAYDCx9Tuqh0VfUC9xbb:/Lu+68si2o72tl1WRmlzQqju1jaKc4wT
TLSH
T186032B3B2C0CCB7E4F844E9CEC267F9A6DE8028B5698895447FE444C03C66EF561A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 31fc0b12bdbddafeaa487fe3f8b5047fc1e381181e06ded4a90aa138918a7c94
MD5 d6c35037e3fce679b41e781da0076388
SHA1 7d55d8bbce31b709354c3b4280b2ad84e5572e25
SHA512 86fa6a18d4c51f73d590861746a4e76be47bb8c245cf71e21ef0d4e337552646308c707fe1977dd9a219b4f125fe440767333e196e986a5b51a8646d246d80a9
SSDEEP 96:KZenS+UcceeMFFEeeKcrEoegGed4O/DItUYWKe0eq7/Eg0KcxEe0gYY72bviKw8F:gZdt5Fk
TLSH
T1E5B1E01271BA73112C3D261883949B568E42F563351CA4AB7BAC44B24E3BF248DFF8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c76f96d3a006e84f5a6c124066168b684ca2f98960b9896fb5328e841e1e1667
MD5 98e4870ea11c68056df472c61360de5a
SHA1 ec9228dd0fb41d4f7a45015a6460c4ecfcd0989e
SHA512 ed85d7da6c7bbe9e139286650ca162ef46a13e06dad4253be1e101818efa30012812f0e4465cd10670481c2112bd6cff41fdc4dd9531f3371c269be688cf284f
SSDEEP 384:nHZcIh8NyD91hLr3b+AC8h8XClht4/oHQvdyBel:vhzXrpWCj6tvH
TLSH
T1D3828D706879AC7709F67145F88B3603DFF850B799946F44E2E8AF2C049B2AC171E916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 ea9eb019aebf934fcd1c399a021fc3c93b8319e7b721981e7de8df0f10641e8d
MD5 3f787d51974eb60874f816c04316b459
SHA1 4c51bae999b3a17f7e92e48b0e6b75f58520cacf
SHA512 f35edcfa0c618a6e0b0476c1e629910b429750131f7d5fb411661a35256114f02af4488b962b0d18bc9238ef0ac3f90ab8e0af7f795e7153ae64622bef915eae
SSDEEP 384:n0ZcI+8Nj091ZLr3b+AC8h8XCVvU/0darVF+48arGXatt4/oHQvdyBel:y+vXrpWCK/iarVF+48arGG6tvH
TLSH
T126B26C7C9C796C7F45AE7B0C668E2A238DB8503BC1B85A54E3D85B1CC03795CF306925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fe06e209888b27e20e8bda6d9ab1dfa524ebda23455bd48c2ad5aafe63f0cf6a
MD5 7d67b101c2ab633b864dbdbb82fa9012
SHA1 643e0209ecb09adb8550b1b99cf84eec7d0083b9
SHA512 ec77ab010e8044cd2d1cc97c4f02a1c8e8461fc878eaf6bbac1853f0e811e78e2d55abb0504f46e5d5261d974b0b6a23064981fca666bd8cf8fa7fd93a3f5c34
SSDEEP 192:lGNr6yzQmiUy50qJY3b+jc50jzorrtPdmXz4M3qvShU6:lGNr6IIJY3b+AC8h8XZlhU6
TLSH
T19912F771A87DAC771EE2B845F48736939FE82177DC856F80D6E85B1C04CB25C2B0E81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 164dc4bafbdcfa0506dee25c6016769d519645ea1503de307b8cad5d46161da4
MD5 33021d27f202c0539a158862f7e355da
SHA1 3051a5d33631f3fe28455f9d9f68255cd7ee8f18
SHA512 325cc4e8dc212577c05166a6634dd091459976c46038614e201fa75f7f2f95e1fb96ebd452952e1ec7ce462424caeb545a2da4840ce7bce6377747ac0b3501ff
SSDEEP 192:nRGN06yMQmiUyOJmq1Y3b+jc50jzorrtPdyMnw+U6:RGN06xdp1Y3b+AC8h/rU6
TLSH
T19E02D931AC787C7B8EF3AD45B44727139FE4112BE9952F80DAE81B1C04D765C234B866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1500c3ee-856e-4f97-89a0-1e58da11a0d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1500c3ee-856e-4f97-89a0-1e58da11a0d7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

7c2f72db-96ad-48df-ae1e-c4519d96190a.tmp

Path C:\Users\Admin\AppData\Local\Temp\7c2f72db-96ad-48df-ae1e-c4519d96190a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

19da902c-4275-4b9d-bb96-6fc01b31e133.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_1925730136\19da902c-4275-4b9d-bb96-6fc01b31e133.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_297533774\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba8bcaf4-a606-4176-a8bf-bcb1a4578f7c.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_297533774\ba8bcaf4-a606-4176-a8bf-bcb1a4578f7c.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

memory/2680-10-0x00007FFE2EE40000-0x00007FFE2EE50000-memory.dmp

Download

memory/2680-4-0x00007FFE31390000-0x00007FFE313A0000-memory.dmp

Download

memory/2680-50-0x00007FFE71300000-0x00007FFE71509000-memory.dmp

Download

memory/2680-9-0x00007FFE2EE40000-0x00007FFE2EE50000-memory.dmp

Download

memory/2680-0-0x00007FFE31390000-0x00007FFE313A0000-memory.dmp

Download

memory/2680-49-0x00007FFE713A4000-0x00007FFE713A5000-memory.dmp

Download

memory/2680-8-0x00007FFE71300000-0x00007FFE71509000-memory.dmp

Download

memory/2680-48-0x00007FFE71300000-0x00007FFE71509000-memory.dmp

Download

memory/2680-5-0x00007FFE71300000-0x00007FFE71509000-memory.dmp

Download

memory/2680-7-0x00007FFE31390000-0x00007FFE313A0000-memory.dmp

Download

memory/2680-6-0x00007FFE71300000-0x00007FFE71509000-memory.dmp

Download

memory/2680-3-0x00007FFE31390000-0x00007FFE313A0000-memory.dmp

Download

memory/2680-51-0x00007FFE71300000-0x00007FFE71509000-memory.dmp

Download

memory/2680-2-0x00007FFE31390000-0x00007FFE313A0000-memory.dmp

Download

memory/2680-1-0x00007FFE713A4000-0x00007FFE713A5000-memory.dmp

Download