hxxps://correos-correos[.]com/2026/09/11/pago-seguro-22220556558

Analysis

geolocation tags

eueuropefrfrance
user interaction
yes
max time kernel
898s
max time network
730s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 21:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://correos-correos.com/2026/09/11/pago-seguro-22220556558
Sample260922-1lwkrsshna

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3192	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345871024566026"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{8C1D7BA7-C278-4C3D-A5DA-87C49A1BCC29}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1104	msedge.exe
1104	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 4704	4932	msedge.exe	87
PID 4932 wrote to memory of 3192	4932	msedge.exe	88
PID 4932 wrote to memory of 4148	4932	msedge.exe	89
PID 4932 wrote to memory of 4148	4932	msedge.exe	89
PID 4932 wrote to memory of 4148	4932	msedge.exe	89
PID 4932 wrote to memory of 2108	4932	msedge.exe	90
PID 4932 wrote to memory of 2108	4932	msedge.exe	90
PID 4932 wrote to memory of 1444	4932	msedge.exe	92
PID 4932 wrote to memory of 1444	4932	msedge.exe	92
PID 4932 wrote to memory of 1444	4932	msedge.exe	92
PID 4932 wrote to memory of 1440	4932	msedge.exe	93
PID 4932 wrote to memory of 1440	4932	msedge.exe	93
PID 4932 wrote to memory of 1440	4932	msedge.exe	93
PID 4932 wrote to memory of 3860	4932	msedge.exe	94
PID 4932 wrote to memory of 3860	4932	msedge.exe	94
PID 4932 wrote to memory of 3860	4932	msedge.exe	94
PID 4932 wrote to memory of 1348	4932	msedge.exe	95
PID 4932 wrote to memory of 1348	4932	msedge.exe	95
PID 4932 wrote to memory of 1348	4932	msedge.exe	95
PID 4932 wrote to memory of 4580	4932	msedge.exe	97
PID 4932 wrote to memory of 4580	4932	msedge.exe	97
PID 4932 wrote to memory of 4580	4932	msedge.exe	97
PID 4932 wrote to memory of 3368	4932	msedge.exe	100
PID 4932 wrote to memory of 3368	4932	msedge.exe	100
PID 4932 wrote to memory of 3368	4932	msedge.exe	100
PID 4932 wrote to memory of 4160	4932	msedge.exe	101
PID 4932 wrote to memory of 4160	4932	msedge.exe	101
PID 4932 wrote to memory of 2612	4932	msedge.exe	102
PID 4932 wrote to memory of 2612	4932	msedge.exe	102
PID 4932 wrote to memory of 3080	4932	msedge.exe	104
PID 4932 wrote to memory of 2600	4932	msedge.exe	112
PID 4932 wrote to memory of 2600	4932	msedge.exe	112
PID 4932 wrote to memory of 2600	4932	msedge.exe	112
PID 4932 wrote to memory of 4064	4932	msedge.exe	116
PID 4932 wrote to memory of 4064	4932	msedge.exe	116
PID 4932 wrote to memory of 2952	4932	msedge.exe	118
PID 4932 wrote to memory of 4972	4932	msedge.exe	119
PID 4932 wrote to memory of 3820	4932	msedge.exe	120
PID 4932 wrote to memory of 3932	4932	msedge.exe	121
PID 4932 wrote to memory of 3932	4932	msedge.exe	121
PID 4932 wrote to memory of 1996	4932	msedge.exe	123
PID 4932 wrote to memory of 1996	4932	msedge.exe	123
PID 4932 wrote to memory of 1996	4932	msedge.exe	123
PID 4932 wrote to memory of 1696	4932	msedge.exe	130
PID 4932 wrote to memory of 1696	4932	msedge.exe	130
PID 4932 wrote to memory of 3056	4932	msedge.exe	131
PID 4932 wrote to memory of 3056	4932	msedge.exe	131
PID 4932 wrote to memory of 1296	4932	msedge.exe	134
PID 4932 wrote to memory of 1296	4932	msedge.exe	134
PID 4932 wrote to memory of 1296	4932	msedge.exe	134
PID 4932 wrote to memory of 1104	4932	msedge.exe	136
PID 4932 wrote to memory of 4500	4932	msedge.exe	137
PID 4932 wrote to memory of 4500	4932	msedge.exe	137
PID 4932 wrote to memory of 1752	4932	msedge.exe	138
PID 4932 wrote to memory of 1752	4932	msedge.exe	138
PID 4932 wrote to memory of 1976	4932	msedge.exe	139
PID 4932 wrote to memory of 1976	4932	msedge.exe	139
PID 4932 wrote to memory of 3676	4932	msedge.exe	142
PID 4932 wrote to memory of 3676	4932	msedge.exe	142
PID 4932 wrote to memory of 4524	4932	msedge.exe	144
PID 4932 wrote to memory of 4524	4932	msedge.exe	144
PID 4932 wrote to memory of 4524	4932	msedge.exe	144
PID 4932 wrote to memory of 816	4932	msedge.exe	152
PID 4932 wrote to memory of 816	4932	msedge.exe	152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://correos-correos.com/2026/09/11/pago-seguro-22220556558
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ff9b117c188,0x7ff9b117c194,0x7ff9b117c1a0
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,7675863161052726,6849549984300163912,524288 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,14384345889252722406,8608193987805852744,262144 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2636,i,3600607556406883341,16151580026845121985,524288 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,934189456871879224,8648335890245273611,2097152 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3344,i,5650580546629067205,15977215920956627435,2097152 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,14320929776226343005,886637701606371581,2097152 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,6904796344435242978,8641604974559507735,2097152 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5016,i,7002908362784461056,6189238760958664754,2097152 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5228,i,18093423669053636653,1920840839456626669,2097152 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,12521960175298591312,10089737767813222772,524288 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3360,i,14132554605517261947,414837575761147176,524288 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,16159529406263630979,5206431850077652984,524288 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,16159529406263630979,5206431850077652984,524288 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5100,i,7622070427089915094,3561460485268250545,2097152 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,9591084539107563867,5230672958090279258,524288 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,2548064071139877882,15631281470877569924,524288 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=672 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,16036557041444955993,1321879284862225380,524288 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,1313546419707087042,9900290125261490104,524288 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,290742162281523207,4709500854785814528,524288 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5360,i,15996679506311218566,9078767989287647652,2097152 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=668 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,17332049929421273317,5505513285989843764,524288 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,13978904195804675087,12015821296789161579,524288 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=2056,i,4419798082042698593,5955271096210088600,2097152 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5208,i,6236507502912143821,11769717906934252926,262144 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,15659372193219234288,1808453324234734518,524288 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,9606484597791326523,12518662767550597902,524288 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,4699945364772655565,13593130241510254261,524288 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2188,i,5480864506973241797,13933854383356258219,524288 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=4268,i,16121843416433409396,17471365837219503615,2097152 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,7938359055051263992,6363952919037105539,524288 --field-trial-handle=2320,i,16646416938937544762,7268296048735693084,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:8
  2⤵
  PID:816

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 63b3e051645c9957f53c538586c3b5463f3ba4412c230d66eb66f06ad6052604
MD5 0070abe22a07fb36149648973e990688
SHA1 c8a203457b36afa6d0ce9b56d26cb7817d832d37
SHA512 cda9b7179f6f997dac4ee0624ff9f92ed77b7c27218584fb07f6b2ebc24d10fc25d45c3d2781b766d834f82054e29ee150712e7ab7d7a11465c468d0f8a31fd1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P79:fwUQC5VwBIiElEd2K57P79
TLSH
T175B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a9e2856f7b8bdcf4e651903050a9f78a4dcadbc91b2bacca38c04067256642f
MD5 8eed843072749c683b08c3e5dbce9bd8
SHA1 87464a0b34e45a134ed6f01b613378b3b1c952ad
SHA512 ce7dc7d95703c8a1e763fcb3eae4091d89a746632583bc1fc73a8c189a11f08c6f50e2ee328053aab1da82c11d6f5f81942259c5654861d13f267c34e76feb7c
TLSH
T199D02B6CBE989EA0E40210340231910431CBC8178442200648B1065708003C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 221e3dccb30d516b1b3c2d51c604a308dfba3aa3dbe8e11c2d09e185e21df465
MD5 7c97d945db36fde78f76660ee3165916
SHA1 fa851b1197f5a5f6ba4d935baba30b0465e8ad12
SHA512 73a256bc0b95a0662925ed2ac0e1668d7a760da5001e2b32fe139724419020254e080420b21ccad1896c60c44ca2663c2a3d2eccb8cb4180b6b0ad628c68d676
TLSH
T14FD02B6C7ED89EA0E80210340230910431CBC8178442210748B1065708013C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 4e45e8be5897b8e1b32737eb273784ffa9c714d75ba090f8e36e5494764bb893
MD5 70d155903a7c5bce471be1f5e3bb31b3
SHA1 b8268d6bbab182639a30f5b7f89bafdade5603f4
SHA512 14f69453d40c90dcf93cf2a991c08382b5d71ff793b6ca392bf0432c8f3eef234d94c591faaa0be8821c3d1c836a6ab629f757be141c98af40de33ed32f666ad
TLSH
T1C6E0209A04ECC35D710C784B8694D7CCC280370FA3CCEBE9370084C970C53987285971
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 4a2441b0c249637fe3425dad723ff5e97844f22b510ea243d61ceed5a797e6d0
MD5 345846ed4af7e651c1c8b35ef0e6f338
SHA1 d3ae5b72583446a5472fbf5fb6686a3c44b1a719
SHA512 92d0330e624a3e93226be62c02aed55abd1ff9e6adee979d20abf5160344148d3240649b3bc375a9ad068e379d1634181d461f1df07b701ef67c99c93192a16c
TLSH
T177E0C8DD05D5D36D71047C8B9174D74C8290371EE7CC6A751714BCC6B1C158976D1B71
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b3e44822b1429e99a1be25f9b4b4214effc96f93541ffb53f3a60c4208dcc1bd
MD5 cfab8777f6b00798189fa9d1c439d909
SHA1 b18564a5e1f92e44b03104f62443f6ff98fc48d1
SHA512 083a0331861e97e94359d50b7648545a6104e1defb9fe3d7606b0ce8f16d3d70f35ffea5efcc48c3066c465f6199276fcba6e4529327492809e021b15ac059af
TLSH
T10DE0809A45D5D35F7105A44F8E988B5C8190370BB7CCAAED671C88C87152744E2D1561
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 c56d82b5bb8e0724ac79fe715ee5a1c66f9d8cd31439848c818a21e18eea7f28
MD5 6e748832561806e5b5a1ff1f346a801f
SHA1 58b9acef0be9a94d3a75733b807ea7bd5dec6a5c
SHA512 004663cc5faaeaeb6a9c7b1ef323349a76a52694098dec2186cddabecb9a767684f4c26807f4e6e43a10454cc04573cf792e197d92457a6120fd55da7b568d4f
TLSH
T11BE0489805D9C39DB108688F5165DF4CC390375BA7CC6EE517168888718694867D1671
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 f815981e10735ec9896dc6c5e8737f800113e9d9d30dfbfa74586424340e61fa
MD5 3a2eb062c99f518541c9b24c1d8ae448
SHA1 d2f52e12981efe3758d724a55e706ddda7dd2b55
SHA512 6170d197418d2693a850bdf119d94f71c27e6ee17a819960fb0b59b844ff97955baa44cb717cae15d47e705a8a41c5ce2fc8515050bcced4cb45d6eaae4374c1
TLSH
T11CE020CC04F4C35D730C644F426DCB0C8386F74AF2CC6AE5770184C4B1450446381561
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9c901c25d23f2414ba3921b7280dd17663828a69501eab69c363f3a26be135dc
MD5 7564080c34c2708ede929c89c7533506
SHA1 3673a7cefd04f3ae13f18d68221825f6bd16594b
SHA512 ebece701d6d9b07eb0f58ab7b173a123115208057f5b1b4603254e88b640c294433b0950f184b5503077b9c753b28c3a67908a7f1c9ca886056aeb783c4391f5
TLSH
T1FA6173C1649640BED79803B0BDDE2CE7B53C5AB966A37D10C59BE43DBB4A3B512072C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bdcd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bdcd.TMP
Size 3KB
SHA256 82727a271614c1e9407f6197707f34c2976284bee7d3d9051d8f60255332ca6e
MD5 9f4248a6b4af553c0b93491c53a25760
SHA1 382686647b5f2e5645cbf56ca9324b7e0f9985ba
SHA512 380bae790024b0cd8d6585d61c71bfc5b9188c89d6ed8b0419b218107e528711f4183d335f53166c1cf306822152944374c1b79ec93afd954f52fb6e8047f689
TLSH
T1236183C1649240BDD79803B0BCED2CEBB53C5AB966A37D11C49BD43DBB4A3B412072C4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 2bc0aa99768c85c91613b7c460e2a9a3fa92a15a1f7a4d53309db27f6216376e
MD5 caf24068637e0eb471252c610d576589
SHA1 3e3dc69c776baaa012c440797a61483427362964
SHA512 eb4a3e010b0beff3500f1b1aa2a5e3f1f2e2d42d28bd2cf7fe705eb6bbcf34ee4f10f3ab171028a12d1110c0e3be1a52a54e708a18bcd3163cc3093f20c7f4ed
TLSH
T1DA1190F3C7D5856E890516F05A24AE1BCE2D0506422C7D25C9D4EF2BD3F3079E00255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 966B
SHA256 2fbf5e591c327748bfbeefc4586c8633878aadb18f550c39dcdffe9e26d488be
MD5 1adf3098a24c2ef6eba69c2bde3177d6
SHA1 af7b8f6d73af4716580b290872456aa8551df619
SHA512 0a2030951486ccc51ae32e914df6bb81463cf2946ab5b3b0ec2032c5ef24a54271e5b2a1c22dbfc858b7d8b6b84da05dc3a00e36c5b282995552f25697527ea7
TLSH
T11811B1F387E1916EC91516F05A14EE1BDE1C0506421C7C5985D4EF27D3E3075E002A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 7be7a88d90be28e75425ad752b63708af86de6d912eaebad402b7ae8778b5b5c
MD5 41fdcd6fddabe96f0c4a9c89dc5c5862
SHA1 46230b911bc04c40435a8917837ceacb27c9ffdb
SHA512 3ad2a020e61cebba46edf2d0b4daa05ed307dc4e0f4c149057efd809a7a21e80c222ed469ce379b81a6b95f679a18853b36a526c78042980bfd84779f07700bb
SSDEEP 192:sxZtRQWM/fZspHIdpVSHW6+WNGY3R6tXIgrJ:sxZtpM/fZspIkHbGH9
TLSH
T1F812B756AE28657B8CC7D20DBB257F53E6F9503261D41E98AAFCC61C04EA6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 133808648bad5fa6a8d21c2738581c470cfe7139f147b888acf3525d8ec7def9
MD5 bc6e664f37ac71686805b88d17257196
SHA1 f2b4ba679e44ff0c022d117ea0ebe0af1985aa21
SHA512 4032fb86824cd04fa4245033ba55fb0636e7f94ae8fb715df4064813aa6430bead6c29112d2301b0485998cb14ceaccb753e7aa05e44b13310241eec95aa7199
SSDEEP 192:sxZtRQnM/fZsgIHIdpVSHW6+WN6Q2/Y356tXIg5NJ:sxZtsM/fZsfIkHbs/X1
TLSH
T10A22C756BE28697B8CC7D20DBA157F53E6F94032A1D51E98A6FCC61C05EB6CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2e4a8388102d79fd7c0534925875d910fc725689dd55f3a3a98f45e9315496dc
MD5 740e0b6f3ac51dc08da505e533e5d130
SHA1 29ead0638d43339008455aadd891f09d9b1be054
SHA512 0d9e5d787ec3c844653a1039f540089ab01de1f40eceef5f96d4bb4d234e4d61143cc8486c39847ca256a47a8777ef3458fcc14d8fe570618ad324edfd4f8736
SSDEEP 192:sxZtRQnM/fZsgIHIdpnSHW6+WN6Os/Y3v6tXIg5NJ:sxZtsM/fZsfISHbo/N1
TLSH
T18A22C956BE38697B8CC7D20DBE157F53E6F9503261D41E88A6FCC61C05EA6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 42b20262461400488d6c6feeb73686beb253b96e62369f11ea282ec823c9a086
MD5 6af21b1174507df1cc250c27310af072
SHA1 cc7137a9d566e87ac6d3e75ff81ed4a0653d15ad
SHA512 0e1e952576dab66cbf83b469c20c1bf6d468185954b9db0da4bfeeaecc9254c029ef9f9cc1ba979aa2a61d385468fa4ef217282b644eccfcf51c74da2686da81
SSDEEP 192:sxZtRQWM/fZsWHIdpVSHW6+WNGY3R6tXIg5vJ:sxZtpM/fZsWIkHbGHD
TLSH
T1AC22B756BE38657B8CC7D20DBB257F53E6F95032A1D41E98A6FC861C04EA6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 484e9c5b4fa513db875f327859479a8762963e58594097402285b792975877fa
MD5 8d3a01cef1878b9c4fe6a83098fae9b2
SHA1 850e9c60ce35f154abc96e3355e3ba62043f2baa
SHA512 ba3409aab5eda708cce68bdd29e0e806ebaff1b91ec707ba2f06cd57599cd4f4138bee84c255830bc1fa7bd23b310ac33d7568bfec6fe76e1d84efd65df3125f
SSDEEP 768:y+30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72VrolZMG:y+30AbSWvS2l9u1jaLmLZ12u1
TLSH
T1B5C2EA3B640CCB7E4FC05A9DDC6AAF9B6E9C02C796648D4047FA984C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 189f961e63af030a9dcd64cf25a96f2d792e8173570d3e12544dd20735e3f7d9
MD5 3f3ffc69fe5b7513d7e11ce853eb1df1
SHA1 4d536690845757a784e1d583536bcf66992161a0
SHA512 95d0dcaf43b83ec4d9012057e3dc7f897902c5ab4574c6a03ad12e9253a44713045bac1df54fbcac71885353bec46f3b4d29376174e6196d322c7ae172ba6b8c
SSDEEP 48:K06lI064I5bkjUISs5K9Q1K5xipYb8IKyLWRsQO00tbYvAISotK9M1OtxG9Yn4wv:KwhyKSQSmdiK2oFfGKUEa6/
TLSH
T19091141070BB5200797D3A4CA6E59B5E165131733029E67BBBBE00B65F2EE041CFE9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c16e891e-559e-49cc-b271-cbc1c2a13b75.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c16e891e-559e-49cc-b271-cbc1c2a13b75.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595a4b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595a4b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 48884239ca418d4ac7c279fd399539334294baac68119b4072ed5380e0057de5
MD5 6807682647c5cb42771aed5ee4c1cecb
SHA1 8b428114008c60923da2bf3ea2ce784fe9ca6d30
SHA512 75d3cd4acf101b9c5f495c8bff80679e340796ca23e3aa6f66d0c4d5af88d1b0dc3502a218c59205641b4a39cba7ec970ee3ba1bfa8af9f035eefe1c824b3c71
SSDEEP 384:jZcIhsN7bzmYbppu7nY9iX5FA+eMrc1a275mmi7:7hUmYbp2caE+rcLxu
TLSH
T1A3829E32AC786C3B68D3D992F84636039EB88167E7C86F84D1ED972D05DB5A90306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 5adf777bd159fce08bcc9fb5d56d686dc6195bdebbaed46000d635a935462faa
MD5 31815ddcd8b8d0227941415d1acebc93
SHA1 1e4ce80c28fd2f6878aa52c6133755e600a0ae38
SHA512 05ff174d09236239e0b9146ab52279adf06dd5c263e75f2ec26a94168716e1f398398e042396fce6cf3859123592473584ae752aea62787eb15012bff7c06f0d
SSDEEP 384:TiiFiZcIrzsNF8TUNTUlIlWzmYbppu7nY9iX5FA+eMac1a275mmi7:TpFQ/AwgUmYbp2caE+acLxu
TLSH
T199A27D739864983BADE69E95F94A3203DEF841A7D6C4BE90E2ED9B1D01DB1DC0306D11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 eb19e0c1b304e3b7269771e5069faf2f9bb0de9ca3a3094b43a9391e27fdafce
MD5 45bdcb1b42cdd56528e4adb87a0a63fa
SHA1 1b48d7734ba06240d89899b7dd0ffe359ad62d12
SHA512 b51fc23f7c80be64537335c4bfe0ecc1733d995ad9d467b9cd1909d7595ad034415cafe081ca3162167fd85ef19a8641a6251c4922323f0f50b6489e10da53ea
SSDEEP 192:LONe6AmwprQmiUy7a26siX5FvY+9JiKXU6:LONe6ipdO6siX5FA+qwU6
TLSH
T1D2020A35ED686C7F89F3AE45B44B36239FA9117BE6942F84D9E81B2C01D768C1307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4945e8d0bf0fa383e5b29ed69a3c40e72659a677f7e5dca5f4fa6ee00145f975
MD5 ca60efe59dc0e0248e2bb3f78317ad8f
SHA1 e08b67980565fca850550574622468312542b55d
SHA512 799365de970d0d589d43b85b5260ef244a2042a8d59ce4f4ae92d36fa1c24711185b3a02f7b999aba16847717d180c1a52ac547b98173e632b9a551156703799
SSDEEP 192:LON26AmwpPQmiUyAa2osiX5FvY+eMalRC/rU6:LON26ipR7osiX5FA+eMocU6
TLSH
T182123B36B8786C3F4DD2A591F04735139EA9526BEB886FC4D5EC2B2C06DF598530B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 041edcb1ed69694bb3c2780bd800c072f68420e2befa48710d84eafe821c90a2
MD5 5da67d56000555edee84c7c7d2f7371b
SHA1 8498cea5eccb92d63d12bf83618c042363795c21
SHA512 f2125a4c10b4cbb09bdca4fe801bb39f3fb16a78a102a65bf3ac5c3859354d001f5404e409b3460c1ff984b4fd3285cc86604a1908ae0a21e49f1ec55387a453
SSDEEP 384:lZcIhsN7WzmYbppu7nY9iX5FA+eMrc1a275mmi7:dhTmYbp2caE+rcLxu
TLSH
T1B4829E72AC786C3B68D3D992F84636039EB88167E7C86F84D1FD972D05DB5A80306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f4e38455-92a8-4b8d-b95f-1eb46cffec50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f4e38455-92a8-4b8d-b95f-1eb46cffec50.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d09b01bb0c5cf1e4fe0cf56d0be23cf9a97b51e1030b72715b88e9a53da4b4d3
MD5 fc26ab97c00787720a0d40fc3e9752ed
SHA1 808b07fdd985d843dd36b01f2b959ecd00d12fdf
SHA512 cebb5c7a562b24b6979b76680fb0a66d9bf1ef36789e89b154542db682b97ddb6c7d6229b03884d9d792e854c38a25f29280c16aee743ef0f9266c3e21d9aaaf
TLSH
T1EC411758BAF91148F3B76E5AAFF6B86D483F79372E06945E10210D4F0662A40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download