3f5760ac1d0a165ebb877aeb94973b5a59be14b8b804dc4c43b843e60d518c1e

Analysis

max time kernel
898s
max time network
732s
platform
windows10-2004_x64
resource
win10v2004-20260911-es
resource tags

arch:x64arch:x86image:win10v2004-20260911-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
25/09/2026, 06:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-2.html
Size 21KB
Sample260925-gtbe1sbb64
SHA256 3f5760ac1d0a165ebb877aeb94973b5a59be14b8b804dc4c43b843e60d518c1e
MD5 af258acb5fae5762118f1fd1ddf2ccb3
SHA1 a35e693a893f94d223c926b295091b5f18385c70
SHA512 c23f8b462d12d049b7b62514ade0d8a96a3afeedb451b132cea635768953461e33dd2639cdb7f0cbdf18b693c470dee8cdecbad27fbc4e1b67ecfb117242b193
SSDEEP 384:glKRztXc0zxkxhxSxwxwSLi9sNYPIiny9s/R1tiEtdLetdOddzpd+O:+/LpYPIiny9s/R1tiEtdLetdOddzpdz
TLSH
T19FA28531DB6A2D5288F282D4D0235E9C8688B2197316C7C1FB69B97B7CC78A514B37DC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4736	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134347923793274059"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{3ECC5DF8-7AE5-4EAA-8BB9-4A50169B1CA3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 4148	2872	msedge.exe	85
PID 2872 wrote to memory of 4736	2872	msedge.exe	86
PID 2872 wrote to memory of 1240	2872	msedge.exe	87
PID 2872 wrote to memory of 1240	2872	msedge.exe	87
PID 2872 wrote to memory of 1240	2872	msedge.exe	87
PID 2872 wrote to memory of 1396	2872	msedge.exe	88
PID 2872 wrote to memory of 1396	2872	msedge.exe	88
PID 2872 wrote to memory of 2264	2872	msedge.exe	91
PID 2872 wrote to memory of 2264	2872	msedge.exe	91
PID 2872 wrote to memory of 2264	2872	msedge.exe	91
PID 2872 wrote to memory of 1400	2872	msedge.exe	90
PID 2872 wrote to memory of 1400	2872	msedge.exe	90
PID 2872 wrote to memory of 1400	2872	msedge.exe	90
PID 2872 wrote to memory of 860	2872	msedge.exe	92
PID 2872 wrote to memory of 860	2872	msedge.exe	92
PID 2872 wrote to memory of 860	2872	msedge.exe	92
PID 2872 wrote to memory of 5092	2872	msedge.exe	93
PID 2872 wrote to memory of 5092	2872	msedge.exe	93
PID 2872 wrote to memory of 5092	2872	msedge.exe	93
PID 2872 wrote to memory of 3028	2872	msedge.exe	103
PID 2872 wrote to memory of 3028	2872	msedge.exe	103
PID 2872 wrote to memory of 2300	2872	msedge.exe	102
PID 2872 wrote to memory of 2300	2872	msedge.exe	102
PID 2872 wrote to memory of 4472	2872	msedge.exe	105
PID 2872 wrote to memory of 4224	2872	msedge.exe	112
PID 2872 wrote to memory of 1820	2872	msedge.exe	113
PID 2872 wrote to memory of 2332	2872	msedge.exe	114
PID 2872 wrote to memory of 3988	2872	msedge.exe	122
PID 2872 wrote to memory of 3988	2872	msedge.exe	122
PID 2872 wrote to memory of 3664	2872	msedge.exe	123
PID 2872 wrote to memory of 3664	2872	msedge.exe	123
PID 2872 wrote to memory of 3944	2872	msedge.exe	125
PID 2872 wrote to memory of 4484	2872	msedge.exe	126
PID 2872 wrote to memory of 4484	2872	msedge.exe	126
PID 2872 wrote to memory of 1472	2872	msedge.exe	127
PID 2872 wrote to memory of 1472	2872	msedge.exe	127
PID 2872 wrote to memory of 1300	2872	msedge.exe	128
PID 2872 wrote to memory of 1300	2872	msedge.exe	128
PID 2872 wrote to memory of 3136	2872	msedge.exe	129
PID 2872 wrote to memory of 3136	2872	msedge.exe	129
PID 2872 wrote to memory of 4540	2872	msedge.exe	130
PID 2872 wrote to memory of 4540	2872	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2c0,0x7ff9338dc188,0x7ff9338dc194,0x7ff9338dc1a0
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,5417018398121732339,940399576507670869,524288 --field-trial-handle=2272,i,1166113949422417706,18320402580494501302,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,8504104440877061712,9803031276289409581,262144 --field-trial-handle=2272,i,1166113949422417706,18320402580494501302,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,17446123306072190879,10385339233348865364,524288 --field-trial-handle=2272,i,1166113949422417706,18320402580494501302,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,3722366902442133600,5413329055797073953,2097152 --field-trial-handle=2272,i,1166113949422417706,18320402580494501302,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,6029289695720112244,5223234599953286742,2097152 --field-trial-handle=2272,i,1166113949422417706,18320402580494501302,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,9440165762627527885,652976805583771045,2097152 --field-trial-handle=2272,i,1166113949422417706,18320402580494501302,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,11618716450575369486,6440391738296303087,2097152 --field-trial-handle=2272,i,1166113949422417706,18320402580494501302,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,14106115335407187510,15612011397620204368,524288 --field-trial-handle=2272,i,1166113949422417706,18320402580494501302,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,3780998835723700919,4971447598267350235,524288 --field-trial-handle=2272,i,1166113949422417706,18320402580494501302,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,13593219688054480041,13141385988376531285,524288 --field-trial-handle=2272,i,1166113949422417706,18320402580494501302,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,13593219688054480041,13141385988376531285,524288 --field-trial-handle=2272,i,1166113949422417706,18320402580494501302,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,5137090168558527061,3086791661148269409,524288 --field-trial-handle=2272,i,1166113949422417706,18320402580494501302,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,13601548308743296826,1776730446645475539,524288 --field-trial-handle=2272,i,1166113949422417706,18320402580494501302,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,4709307838576624843,1660516566786666097,524288 --field-trial-handle=2272,i,1166113949422417706,18320402580494501302,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,4326166011516362730,2807004799411345276,524288 --field-trial-handle=2272,i,1166113949422417706,18320402580494501302,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,9093707234339378715,13476326523518261315,524288 --field-trial-handle=2272,i,1166113949422417706,18320402580494501302,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6084,i,10028095320868666421,1308273046956145206,262144 --field-trial-handle=2272,i,1166113949422417706,18320402580494501302,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3068,i,10390809342109504674,7598885623610300093,524288 --field-trial-handle=2272,i,1166113949422417706,18320402580494501302,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,8179897325128200297,1746466724296748551,524288 --field-trial-handle=2272,i,1166113949422417706,18320402580494501302,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,11665625519676478744,2732525399900379250,524288 --field-trial-handle=2272,i,1166113949422417706,18320402580494501302,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3356,i,4088526814104854180,5070285910778693705,524288 --field-trial-handle=2272,i,1166113949422417706,18320402580494501302,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:8
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3344,i,688612385834646500,16913989281725856851,524288 --field-trial-handle=2272,i,1166113949422417706,18320402580494501302,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 edb625439c84b83ecdae824e6ac924348a45744772a3506f3802bbc6b46d945f
MD5 de4fc8ae4f7c418ad042adb75f107910
SHA1 d19322b09e376558d0cf90a112bdfc90e050557b
SHA512 910e9ffec80b57746252686897e0578cfe9fdbc4d3633a4aef97f5ccf6b2eb0d321b429152295b77a5c07a4139fbee781ebfc4f4a73ed53fb86f62a2048da618
TLSH
T198E07DAC07C8C3FEAB08E45B417C470DC2A03B5EE2EC7E1A17008688B483048B3C26A1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 e9333162794770c27d06f035f033164daeda109c5247304621576b0c44a12b3f
MD5 aa8cfbf96ce1edc9f2cde30fad483426
SHA1 98f45ad2f8f6642e9acca6932445fcf6dea4d24c
SHA512 ec1c1acfcfe22ce08fd271ca9dc8bcdc6d63d83b8c85d2841dd903d6dba2ef84ba651f28af840e82ff5e5aed3253682152691aad6570e447afa9504bad8749c2
TLSH
T199E07DAC17C8C22EA74C64DB416C4F4DC288372EF2CCAB1A1700A6CA7801040B2C6E91
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 1d0c5f1c59eac82d6ece09c14d6e63ea3c9a73db025b5df1e6d8882dc07661ac
MD5 d9d926423b2a3b62c41cd9e0feadd56d
SHA1 239250d0b1e8b2fd8fa22a93b4c11a1a4cf95d39
SHA512 d33bc172f8389fccfbb4c82fb47a58f98089c3e8b8a2d4aa25054c5dbada602e3e3d3f106ecc26b714eec68d7209bc0ac4086d2bdc449fe05036f6706b967bd3
TLSH
T11FE07DE807C8C36EF3186C67856E571DC2C03F2AD2CC6A5A1700F5897AC3144B2D7AD1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 ee9267b5db66c1da0e21667b3ad1b28fb7c64bd0b36e3d9d14de2d3e0d505ca0
MD5 2ae6ee144b167c5d4f4e8684447a1603
SHA1 da81c6582d8d23313a9aa3566ba36df2f25d0098
SHA512 a5391e6c4b68af9439fc753ae433b850f1bf512c7619b53c45df3a70789851c17f57bf71b84e2981fb4bdb79e23c59376440502b20439b61f25d3314abd03e41
TLSH
T15E51718646A040BEF7D869FCA0E5038BB73675B042E75E0103B6DFBA2BCF3544620C60
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592c75.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592c75.TMP
Size 2KB
SHA256 d026d85cbcffb9afc169874006891df6eb040d2551a28d27d2496c7685bb7b4b
MD5 0fdb6f596d3d78016f1e12c645160063
SHA1 7533c4cc438db1977d2c59abafed1d7f732e64bc
SHA512 a528ccb1acc22e2521451dcf2945c80488fa8a36e3a5d266121b4148aafb41b76ecc803be396dcb16875015e09a76ae1087fb71650f1f08586cde5b6f36c8f02
TLSH
T1F551838646A0407EF7D8A9FDA0E5038BB73675B041E75E0203B6CFBA2BCF3544620C60
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 478B
SHA256 2db57b6b38a3fa6799651d75bdba64a6615d1de03b0fabf69ac99a911c8370cc
MD5 c69ca48e1317d04f6a31bcbb745ad7ae
SHA1 f69b1f1c130faa32592d9d541a9ac9749ae6de7c
SHA512 102b076575be9c47ac5595a7a451116322a1fa33ce55fc07ebfad5b36ebc895e664b790a57ffeebe0588b9ae9d2266cee676408e45bf93bf962cd6ae25197e1c
TLSH
T1B6F09EF7C3E0557E8A1182F05A18AF1BCE2D0402831C7C55C5D4AE2B93E2078D00089B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 673B
SHA256 741d22c590049d91ab8d19ff364543add429ab7f92a41d6ae63337cd1e839739
MD5 ad10db48f03fe1274248d1162d119c7a
SHA1 ac2997078d074207f6a5c047a74f410335a73a98
SHA512 36842635271de89b930437d7409506521c6742f41978fbd21f5dc1bf2b025a357d4770a620093beb1707f0415b04e9d81e4d5b0962147f2fd86865a5fe285c2c
TLSH
T1C1019EF3C7E5956E891512F05928BE1BCE2D0541821C3C59D5D4AF1B93E2025D142D9B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 b504ca85fce6b4f56c51d1af5842fac9c0ba0e17348b12f57820afa98dd2a91b
MD5 0e0853267351161471b19e3e656524d6
SHA1 25da9d03837b157f5055796a60efa89777cfa9e2
SHA512 1f2bfbeaa77409125cc10f8ec682e53876b876b0d953b04c10b26aab87f6c02c364f5989db374ce35f181f7278ab63c1c3cba8b0dce587235bae7ed16b573db7
SSDEEP 192:sxZyLWj/fwsF+S8IupdEHW6+WNGYYBao+5IgrJ:sxZyqj/fwsF+SciHbGflM9
TLSH
T1B71295156E28A57B8CCBE20DBB15BF53E6F9503291D41E98AAFC961C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 fcf52e33332b91aff05d1d03cc27450f2f1d5d465649f889b648692557c20cf5
MD5 3c6f9a8fd34c2c195229b9422f8f7600
SHA1 5f58a9b332f81b7a63aec5365eb47b2cf6ddb33c
SHA512 b7dfc363ffc4d623453a2fa143a6f2afc5ae19cb991e3b68c54aea65f965eaef024a53f1323ca84afd1857d06d563a1cc11292856e4df74e9b81b21a73b6043a
SSDEEP 192:sxZyLWj/fwsbdS8IupHEHW6+WNGYYBxo+5Ig5WJ:sxZyqj/fwsbdSckHbGfiMA
TLSH
T19E22A5156E38A97B8CCBE21DBB55BF53E6F9507251D01E88AAFCC61C05E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 7028491f997c928f85d868447a52dbf41ac7a72ba4ca570cb5926c7d4a0e6a90
MD5 83eb2db2ef5278f1df3f4ee7b96be346
SHA1 bb9caf302a18aeec68cc865e262900a66e4fdc1c
SHA512 e678932ced33fbd695224c0527fd829ce3721845f0203f588823c59b3ef2f9d5c3f6f0c13402468c61449f0b1e68187db655be445eb7f1320bf8e2e307139776
SSDEEP 192:sxZyLWj/fwsb+S8IupdEHW6+WNGYYBao+5Ig50J:sxZyqj/fwsb+SciHbGflMC
TLSH
T16912A6156E38A57B8CCBE21DBB55BF53E6F9503291D01E88AAFC961C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 bbbb78fedb1a823db6d78e01fa874e7cfd5ae9fddd2127dea32d7bdd1d816520
MD5 6f9b8b796ebbfcfa7483856c2d219d8e
SHA1 e87114db93f9f13b3b33aa7a0a88f2a4318137f4
SHA512 17cef47d0f7e8941948907a45411d8eb8fa6f765ee1ff7c14fabc3723264ee0fbd796cee24b50546fcc9506ff9f78b4571cf9f6b5761b024d558ecd3c02ef397
SSDEEP 192:sxZyLWj/fwsbdS8IupdEHW6+WNGYYB1o+5Ig5WJ:sxZyqj/fwsbdSciHbGf+MA
TLSH
T14322A5156E28A97B8CCBE20DBB55BF53F6F9507251D11E88AAFCC61C05E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 61b59726559fbe3ddf3b1ab9fd648e172099f70b92cb412c777d452f16d50917
MD5 9afc96fcbd6a4c990ae01fa6d652a716
SHA1 78ded1dde2b321db0e47f0d392b9355b609af44b
SHA512 59c260ffdf1ba09e247c737a93a5b7e3d0db206640fe03ea2d9f19a31acad5e9eabed59a076013bd3539e80a5817bb1ef7075a41def251d48bdfc0e84df3b75d
SSDEEP 768:PkyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXMrop+6I:PkyYR7jWv3NpBu1ja/CL8OXXW
TLSH
T122C2E92F640DCB7E4FC01A9DDC5A6F9B3E9802C7A6548D4047FA984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7019db8f-ad1a-4a26-ac14-60594cf0d33a\index-dir\the-real-index
Size 168B
SHA256 ad273175528d09d7361105997d7c4f6aa483be7f56912623898aa8c09ad0e96f
MD5 d68ec215874848e7ccbd37a21082f98b
SHA1 ca690f75844cfe19ae2826983f1fa83338c13157
SHA512 98f561fe00e3de08176be26d98dc611193cd663bbd78984522615d29a43c66d720ce1f6450bbacc08206e9c96e86577fa1c356ef91347774905c98160a722150
TLSH
T12BC02B24CD911040F0D18F3094BF1070AA6014EE1154051384EEA0188C163C5D044214
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d733f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7019db8f-ad1a-4a26-ac14-60594cf0d33a\index-dir\the-real-index~RFe5d733f.TMP
Size 168B
SHA256 7e320f6f3cafbc25a7948981628701424ede7a558de175dca055004df8ccaa33
MD5 4c0562167d6981d3b6638269e6cde8be
SHA1 9e0b64a579972969960c056e8810a590942e6814
SHA512 6e924e12e8368ae52073d990f23fbb11aa7c4ae4aad1c617ae85ee0e7b228226341807d309b22646d8411d9ec7d1432e3095aae3d5501190b8dee96e3dfc5e66
TLSH
T153C022B0CE238280F020C3B00CFB20B238302C3CC0200FA302FEE0808E03EA0CA82300
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 f978c9efc87e8a46950927ce60f609fda9bc2ebc84d6bf4418f8f80173f0faf8
MD5 785fc5d4096d3c147734fdc0d40f5052
SHA1 bf86bffb280c2f55ae6a8357016c358529ac13d7
SHA512 908b380159839b8b469d75ce18186ff1866f7d5a80b990687b9833f57561804912611a7165a42adf7f2ed3e042a92bd8e6443f3cd4a371f9777339de8a741c59
TLSH
T168E0D8BB2DE65810ED6F97E9147140E9050279548D44BCDF241BA79720B23593486C62
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1e249e96d24d5298b60757fc7e06380e30e4f6cd3962cf0db6fb7ba280e2eb31
MD5 6e2f999148dd6478b6919c66b35015c1
SHA1 4623fe59aea8f2a459c02772ed54228fe67daa99
SHA512 aa60ad096d682b7b18f6e7100428b0da557cee628f2ccf8c90a97559f2551d2d154a1db4a943be4f297c483808631157e5b307387a97c6ae7baf50041dfbfd06
SSDEEP 24:KZkqkK1XhMKnLYvfUdLIgZYK57hhzY1jZIS127fLx1yXP3kNyshJKqqNvO1dgIgD:KQuInK/awfyFNItKWIo+DIhKkocnyJV
TLSH
T1F1914E1431BF121179BD3D19D1A18AAF434231B67418E63B3FAD10A24EABE196CFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4bd1356c-ef27-4ef2-9471-0b2ebc52e952.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4bd1356c-ef27-4ef2-9471-0b2ebc52e952.tmp
Size 22KB
SHA256 e7dfcd2af3cefc7ce57f7bf6991d35a5d20958cb42766f953d9e1c76fae333b6
MD5 5cb2b7e81b4702abd9866dd283d10b96
SHA1 5384d524ca48437435a367dbbc158070ce70493b
SHA512 c5558f99f45f9b2e4cc7c7fd80211556401a16d808a8b34aaccf6cba23f5b5a5e834235a19cf251015bda0baa50c8bea1b0a20624e7e483f5a039e0d86134f85
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uQ:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAZ
TLSH
T168A2B81DC81C7E3257CA2F7D6A2F9DB276CA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 76f5c158559b9d01d82d7f3275e2b7aaa11809eae2d2d0fbe64d5a8f30d0d5b6
MD5 c0ac4fed97b3c31c94298bd6ac0e24ff
SHA1 1f87d2abdb1ec5050d0c02d4e521f53a183a0d0f
SHA512 af27a37eca6ad2e6be693a201a35dd736dd9d57f33b343156afc5d21117026f53708bd33e88585624203627ed165145d274cf6d4558a51f55cc33fbfc1de0fc4
SSDEEP 384:mZcIhsNqU1ticWYQX5+DtBd966uskCtgOIwZOy6soN:0heCLkDLi6uskCXsAu
TLSH
T1BF827C3298B89C3759E7F285F08B3213AFF49067A5C46BD0DAED5B1D01DA5A9130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 924f63212a6acb269c3c5162df9613645a0934a83fea69db62512eec14f38d80
MD5 8e9a5f0ebaf1cf9826c29a4ce2453ede
SHA1 764b8eefa597685833b95b696da26f142c72b9b5
SHA512 6c87dc3fb1f80a0ece692d522cf7623eda9966161d293581deba93944cd7350c3e3d35a39072780692df023444d3748b6f0095739ed64e41199929ba8c022a00
SSDEEP 384:Y167FiZcIXzsNP8TUNTUlIl4ticWYQX5+DtBd966uokCtgOIwZOy6soN:FFQDmwgoCLkDLi6uokCXsAu
TLSH
T181A26C3348A8893B9DFBA785F58A3203AFF450A7D5C5BAD0E7ED5A1D00965EC030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bd0acb4337e0ae4002d7b87c807d4ca0a67fbe5f887e11a5c366313e2e8b9558
MD5 f828def5994a18dd8f50a749c59612ac
SHA1 6170db7a612c99ee491d06c811e815e057168d33
SHA512 c5fff8d2b01771153ee7245349f6ba3d440efc7bb3a56b7ac3aa40c11154f123eba9a5e1bb4c9c1f3cfa5c64895b447c1a2229ecebc1859ad2f6bd98fdb9ea95
SSDEEP 192:EON36nnHGQmiUyxnQYcX5hQDP1u+Fd4MRMcyGU6:EON36nCaQNX5+DtBd959U6
TLSH
T17402D935ACB87C7B8AF6BE49B04736136F942177E5946BC4DAEC5E1C00D766C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 db0c4bafd9d14059aebc7920ba76f2a23b979d999797ad712f3abc404e0a4541
MD5 c6a6713ae4155999377a32d279fbc191
SHA1 6a86eb72021a829559c35d5e4450491de989fd8a
SHA512 04385c97e78ffb789926a23438a335a634efe962c442c11aed62229b287800cb67396c901da61d390203364bebabf8e1c7e85dbbc3bcfe064397ee16c3a33f6e
SSDEEP 384:gZcIhsNqU4ticWYQX5+DtBd966uskCtgOIwZOy6soN:ehZCLkDLi6uskCXsAu
TLSH
T176826C3298B89D3759E7F285B08A3213AFF4906795C46BD09AED5B1D00DA9A9130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 247c6a53eda8efff9ea52ee2373e054a65890d1a28df6af6cacb2b544df2adc5
MD5 295648f478bc96a4d8236d84bd3b6979
SHA1 3a57f5b0e155f30c222c97c5c3729b9b3c84e6c5
SHA512 388c39f3c05bd36fdedf4b6689ca27059457d06f150f66928c7929b6e889ebd5ca1bf56ba4f6f7e9d13a7604188cb3a8a36bec967410b5c08c0c4e528e1285e0
SSDEEP 192:EONw6nnHyQmiUyvnoYcX5hQDP1u+Fd4MlI/SuPg3K/5CU6:EONw6nOmoNX5+DtBd966uEkCU6
TLSH
T152120C35A8A4AC374ED2B595F08735136FE45127E9897BD0D6EC2F1C01DEA6C130AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b0b7b24-bf81-4b1a-b53b-c66df36dab8c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1b0b7b24-bf81-4b1a-b53b-c66df36dab8c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0d4fea7fbdf300efda77e0daf33883b2cc4684e4563910433da1852ddaadbe14
MD5 1f882a1b7461e1494122ba580b131339
SHA1 5b4849bbdb690bbffdaa2cbe9b15d9b65170f2ca
SHA512 fc4aa3a7fd363947c17c8229005b8c1ca9158457c4346e6e45c0dfcd81f1bd84b98dd64df99f8d376748a8b20d7b58b84c494bdfa112deaed2456fd1604610e1
TLSH
T19E41F65CA6E91008B3B76F569FF6A8BE547ABC733E06D06D10010D4E0B72B40C9A2737
MD5 SHA1 SHA512 TLSH

Submit Download