a980b60a8922f510d2da527e74ec9443a57dcc65444dbd6a3ae87dceb28090eb

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/09/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
merlo-escucha-0.5.0-6e9d3bea.html
Size 552B
Sample260928-pp6pcsvwgy
SHA256 a980b60a8922f510d2da527e74ec9443a57dcc65444dbd6a3ae87dceb28090eb
MD5 ad76203cbb9feb6a77342842816f7b51
SHA1 12150fb48e15b3daa031a2ad5f3d011976a1c068
SHA512 85b1bd5c232a000551ca69d9832ecfba1ae61c42ec8e91847de76b4b711f5a39aa3d0bf71f4062f855584c64b3b526d4d11885309f7abcdb42c7cfefefcab088
TLSH
T146F0909F5F12287F2E238471F4C35169CF680A17FB9925E28748011F7ACA04549F1FAD
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1192	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{D4F83467-8BC5-4363-8BC9-43FBF80907CD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2084	msedge.exe
2084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2812	1672	msedge.exe	87
PID 1672 wrote to memory of 1192	1672	msedge.exe	89
PID 1672 wrote to memory of 3228	1672	msedge.exe	90
PID 1672 wrote to memory of 3228	1672	msedge.exe	90
PID 1672 wrote to memory of 3228	1672	msedge.exe	90
PID 1672 wrote to memory of 4616	1672	msedge.exe	91
PID 1672 wrote to memory of 4616	1672	msedge.exe	91
PID 1672 wrote to memory of 3516	1672	msedge.exe	92
PID 1672 wrote to memory of 3516	1672	msedge.exe	92
PID 1672 wrote to memory of 3516	1672	msedge.exe	92
PID 1672 wrote to memory of 1664	1672	msedge.exe	93
PID 1672 wrote to memory of 1664	1672	msedge.exe	93
PID 1672 wrote to memory of 1664	1672	msedge.exe	93
PID 1672 wrote to memory of 1568	1672	msedge.exe	94
PID 1672 wrote to memory of 4748	1672	msedge.exe	95
PID 1672 wrote to memory of 1568	1672	msedge.exe	94
PID 1672 wrote to memory of 1568	1672	msedge.exe	94
PID 1672 wrote to memory of 4748	1672	msedge.exe	95
PID 1672 wrote to memory of 4748	1672	msedge.exe	95
PID 1672 wrote to memory of 4160	1672	msedge.exe	103
PID 1672 wrote to memory of 4284	1672	msedge.exe	104
PID 1672 wrote to memory of 4160	1672	msedge.exe	103
PID 1672 wrote to memory of 4284	1672	msedge.exe	104
PID 1672 wrote to memory of 1720	1672	msedge.exe	108
PID 1672 wrote to memory of 4416	1672	msedge.exe	115
PID 1672 wrote to memory of 2648	1672	msedge.exe	116
PID 1672 wrote to memory of 2848	1672	msedge.exe	117
PID 1672 wrote to memory of 2648	1672	msedge.exe	126
PID 1672 wrote to memory of 2648	1672	msedge.exe	126
PID 1672 wrote to memory of 2084	1672	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\merlo-escucha-0.5.0-6e9d3bea.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb7641c188,0x7ffb7641c194,0x7ffb7641c1a0
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,961338532613199623,16504370203514892338,524288 --field-trial-handle=2324,i,794913396122833623,17067382054288546779,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,12337276132122236048,5693823136979054674,262144 --field-trial-handle=2324,i,794913396122833623,17067382054288546779,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,15223034941294488826,3801661420693078872,524288 --field-trial-handle=2324,i,794913396122833623,17067382054288546779,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,12630185969112771663,11868275912834536768,2097152 --field-trial-handle=2324,i,794913396122833623,17067382054288546779,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,6477428663896985746,6766167967977673749,2097152 --field-trial-handle=2324,i,794913396122833623,17067382054288546779,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,14043320267447914401,15282590592175261914,2097152 --field-trial-handle=2324,i,794913396122833623,17067382054288546779,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,953381626095470101,17283568551085367327,2097152 --field-trial-handle=2324,i,794913396122833623,17067382054288546779,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,16228664882683303881,4153288339336408694,524288 --field-trial-handle=2324,i,794913396122833623,17067382054288546779,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,16112954240467437426,2668717443009804157,524288 --field-trial-handle=2324,i,794913396122833623,17067382054288546779,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,10917499545406852517,6324112792640524517,524288 --field-trial-handle=2324,i,794913396122833623,17067382054288546779,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,10917499545406852517,6324112792640524517,524288 --field-trial-handle=2324,i,794913396122833623,17067382054288546779,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,6849569944623955242,12589616718682041031,524288 --field-trial-handle=2324,i,794913396122833623,17067382054288546779,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,17652466398951838891,14132381267551679257,524288 --field-trial-handle=2324,i,794913396122833623,17067382054288546779,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:8
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,13771696731488339074,6239607436246632521,524288 --field-trial-handle=2324,i,794913396122833623,17067382054288546779,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,6830619466619383112,2398099529303981514,524288 --field-trial-handle=2324,i,794913396122833623,17067382054288546779,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6116,i,7136611781669458838,17477938081040855337,262144 --field-trial-handle=2324,i,794913396122833623,17067382054288546779,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e6cd13b34cf3f758c2f4e7c55e8801132cc91647c947cbafe475ce8928ff2c2f
MD5 b36cb034fe7df72fefb0bfa9340c6a6f
SHA1 8471623779cc15452b8cb60924e40c193607fe42
SHA512 6f72e14e09c254a1a7d581eaf85757baf7b4cd74f1e1978ecd80b20d91bc8f87462f9d782c3b0604a3b7c22e084b46d1afb4dd162a82905a3464ca87d8223542
TLSH
T1C6D024F477D14010F4713531007CC3C300045704105443303C33100C0C440C5D117D4C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0eb401f66978e87d2cbbc466eb76feae4276117779a3556dab8f5d2b4b8c8b65
MD5 3dc59cc9c2573127765bc5a3e50d193f
SHA1 32fbc084369c7364e0e3a188448888f680c7970c
SHA512 7cacef888d3a52cfbb4ec7c40e9ec2a3fd5252cc5c9058bf75bbbecbb8e88c3db0c672a61c327ef32873f35d5a3754acc933e0761a3b42f2be736b0908b50a06
TLSH
T1EC6139C65123C2DEDB5982B587D921863EBCD6B8A2C3CD9102ABF83B7B0EF965000153
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bbe8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bbe8.TMP
Size 3KB
SHA256 86a7f7c6fb210a6464519c8c5e7adff6aa829cf968836c0d01af3db23c48368a
MD5 5ab83f911000c9407d210d2470c74c42
SHA1 c63604fb6cb3233e8067aa4b808124136bb1ca5a
SHA512 9ef90e20585eb7cc213b28f0ee40c2e8e41d91e55067ce6f8ed567457278122233e827fe41d10348f58c681dad4c1ee2db7c3895606f80d983b0a04d86f05b38
TLSH
T1FE613BC65513C2DEDB5982B587D9218B3EBCD6B8A2C3CD9201ABF87B7B0EF965000153
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 bc092a3dc2027cfa14c17c756d81391b1df8d2244b61cf36b54dbb454a002f74
MD5 dd11d06b377a6b21c215d18a2891195b
SHA1 3131f2a2c7e8d9522e8ea71cca8bd43f282327df
SHA512 5bc66a78afba651dcfa33995331a61ab859edcf652c00252cf6e88afff85b8e6689c8277a6c5e1ad47f5b7bb0164e4e25de8abac2849aaa30277f64822b31e0b
TLSH
T1DE117DF3C3D585AE890116F06A24EE2BDE1D0906421C7C1985D4EF6B93E3475E10199F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 aab7266468103cb927b0d4556462f58d467eef9a9c5e14533a1b208cc8ad3373
MD5 aa29592b90374d9fb3f6f7c15a936e63
SHA1 eaf4957b8ea762985be7b6cfa20444b3a402b88c
SHA512 4f3acb950c14207e9f8cf0f7206e250de620428333c4ec06e5dfde86938109664a7e74885709bf9a87a87181d049a555362ca3f6a76996f10b1ef721634d2149
SSDEEP 192:sxZrRsWt/fIss8pIdpduHW6+WNGYapYQ4IgrJ:sxZrdt/fIsshsHbGK9
TLSH
T19C12B6526E28A57B8CC7E21DBB25BF53E6F9503291D41E48EAFC861C04E7ADD121780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8a40d0e262387739e418288d8b3a4d00f033662601f8c2f63b7bda7087f853f0
MD5 7b7780d665985f20cdf0648f9dd36805
SHA1 c91d2e6fdb828d8a6bc9707184cbc4bc3b90346b
SHA512 1817c1025a51c6c8e3bd3ef3017c002ef2aa8017b65f0c91e3a6611ecf9e4bc81e5c01f80965064e472d357e91247bb5417c5647b951c339db3494faec04c58d
SSDEEP 192:sxZrRsWt/fIs18pIdpHuHW6+WNGYapCQ4Ig5HJ:sxZrdt/fIs1hOHbG8T
TLSH
T13D22D8526E28A97B8CC7E20DBB15BF53E6F9503251D11E48AAFCC61C05E7ADD121780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 40b83ed50631253b0a997f1d801c5ccc5214461368996576e7291542b6ec9b4a
MD5 57c3d3822511596ca1da7a1bf806e1eb
SHA1 1c1d1f670eb8ad545169c3491a0bd76be4f3b942
SHA512 a37bb69b29cca4292b493c16ca0e8d3d3b4951112a043f41d310d545121275de93f2dc69ec839079eb6338a982b4f5a926cf69ceff08cdcea547216986e7a7f7
SSDEEP 192:sxZrRsWt/fIsX8pIdpduHW6+WNGYapYQ4Ig5tJ:sxZrdt/fIsXhsHbGKd
TLSH
T1FD22B7526E28A57B8CC7D21DBB15BF53D6F9503291D41E48AAFC861C04E7ADD121780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c5ef7fabeb2e7a14968980853b01c0d81b87396e0f4b2ac205e0eae70bda315f
MD5 7c49ab057c03b973d54c9b3b5513cf2d
SHA1 30d7081db0f035e170205ba2c3581203f42aaa95
SHA512 a0d11b544d6fe52d1fb274b1adbbafebc516bd42e937a5a6cdaff9a9e25ceed3a6389408795b5e042ca9cb26ee122544e841c894ec50cda27b40ca47fbe8b09a
SSDEEP 192:sxZrRsWt/fIs18pIdpduHW6+WNGYap+Q4Ig5HJ:sxZrdt/fIs1hsHbGsT
TLSH
T1FA22D7526E28A97B8CC7E20DBB15BF53E6F9503251D41E48AAFCC61C05E7ADD221780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 56913c2df4fd1bdd834eef7ae1b2f378b23219af3f8dcf88aef89f59ca6b18e6
MD5 a96453ca200e1f6afc235a5d5971d1ca
SHA1 815abced7988c238136ce2860b563e5807ceef87
SHA512 fb9e913eb91eb8e296c22ace83113fecedfbf1c73ef80490ae1750239a89e73618aba184e7bdc850679e02a9acc7b785a0d0630d5136ad58dcd7401856f8e04d
SSDEEP 768:muWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7Fro4Bfe2mRv:muWPcLKWvKeEeu1jaClLiF7+4BW2mRv
TLSH
T11AC2EA3F640CCB7E5FC01A9DDC5A6FA76E9802C79A548D4047FE984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5957cb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5957cb.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 7b3feebb9e75fc2baa797361bee23ca57f286c3d1198cd36333041e2aea6e71b
MD5 cef87fa1455cab60da80b89bc3984ae4
SHA1 9549580f14072a92cb1fd760b2d75a12e0602ec8
SHA512 c0984dd3518991a214b68e900b1a19366f7d682549e04ba56cee739539c5ff380f9b27ecf72a95a76c75cfe2fda2fad04ef576b68c94d46554cd3f52c40bc61c
SSDEEP 384:kiFiZcIGzsNX8TUNTUlIl6JR170uzIGmEb6qxiptgOIwZOyHhoo:/FQ2iwgsPG4rbRxipXsY3
TLSH
T1ADA26C738CA8DD7BAEFB9A44F54636138EB44167C6C5EB94E2DD5A0C00EB1AC130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b29d7d9eca37e41edf84c92cdae840fc31a1b7c16484f1324fa635dbf95ecf62
MD5 3889ebcba2c78d28d74d48f59a9e030d
SHA1 7776e5b9b93771b5ac5af15397c97044b20687e2
SHA512 9e36203311fb918cbfe4c3a754a829ef4df7393bb7a333265fb31266a3e506b16ef14c78de11b60ea268c319496ba78f580ce041b639073e7ab6d5edd8e24c3c
SSDEEP 96:3qONkxQsjpfe/tyng7X5ih/cIPURHl8h4otop5hYDZNBnP9ZvEI0IG2jb3099R1q:aONx6IE7QmiUyUZTPuIGmE7ROC7sOCU6
TLSH
T13702E935ECB87CBB9FB3AE09B4877A235EA5112BE6912F84D9D41A1D00D725C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bd0796915ea9218df2ec4d2d8f11b88719fac67283ee432d4a20c94764bd8b64
MD5 31014746e820404de52466711c6074ae
SHA1 6108ef1cbb059f10e20c560e4ee84f67cd5eeab8
SHA512 d7f5584a1e0df0b71f30a05c4432c0afdc06b029e572e383a4d06ad40421c8c7a9e578e31b7430d2376634892c4bfb702e26a9cfe87dc9fb4f2ed11e66adbcad
SSDEEP 192:aONo6IEyQmiUytZTKuIGmE7RYW6+27HiqJU6:aONo6DuQKuIGmEb6HHpU6
TLSH
T133120A36ECB8BC7B9EA3A804F48739135EA54227DBC96F94D5DC2A1C00EF25C130B516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d4459161eb238c641a5c843ee69ec7c6b950c5acf1084142952f2798316d45d1
MD5 287e942fddb0cd748a03aa6c1e21baeb
SHA1 273f7fb12771d7033ba2577854afc61966e87c70
SHA512 a4f5a50cac5aacebaed01f1c57e10043c0ee3b24b70d318f6a39595caab5d2c795351cf7f634404178dc6c46bb8044a3cc5736c7e599cda0be46825ef07599c1
SSDEEP 384:eZcIhsNNhJR170uzIGmEb6piptgOIwZOyHhoo:chOPG4rbwipXsY3
TLSH
T104828E739C78AC7769F79500F4473A034E784167D7C5AB94D5ED6B0C00EB1AC130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1a5dce9abedb2718e94025388c4877d2d38a1db4c416d97efc8152957c70dd2d
MD5 72038084b397e5ab7ce4fcf3b716b270
SHA1 e294bba6d19f08960a256d857de29d6cb88d838b
SHA512 7d2cd1d795979eca533b08fef31e1a315609f16cc27c0e86f5a125318861a53024264c5f4b7a09f40025dbfde57117ecee739d91e5a937369ea6db34205e632f
SSDEEP 384:iZcIhsNN6JR170uzIGmEb6piptgOIwZOyHhoo:Qh7PG4rbwipXsY3
TLSH
T123828D729C78AC7769F7A500F5473A034EB88167D7C9AB94D5ED6B0C00EB2AC130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6196a93b-3094-413c-9aad-9712e3f6a90e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6196a93b-3094-413c-9aad-9712e3f6a90e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 31242b244a658c031ec31c14a4cf48e112cb57cb242bca4bbebfbf036d35d232
MD5 2fe44340259e678335f0ea747cff5164
SHA1 e5c150d264f0d93ca240ddd9df675d50827ec44c
SHA512 5abaa6f27ee4c927958d4120ddce52866282be5f4df427c71c9a91d72fcb7232a140d65843b030c9511aaca8ad121fd90d92086758230e8c8b043df6601382e1
TLSH
T176413A98B6F92148B3B37E565FF6A86E487ABD732E0AC45E10110E4F4672A40CC71B37
MD5 SHA1 SHA512 TLSH

Submit Download