edadbc734302d0236e60a05b2e40deae7e94da16f6df5b1f5a34e28e76361901

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
grupotenzo.html
Size 237B
Sample260930-menppawzbx
SHA256 edadbc734302d0236e60a05b2e40deae7e94da16f6df5b1f5a34e28e76361901
MD5 26c78b9f1d5dffcc5cb35cc2409466db
SHA1 c07f693ecfee065ea3ff7dc0df739632ce2425de
SHA512 a7adfa1618d64cdfbe6abe386b9b1efb58d22ecdc394575abe6887e21140108bb7c14f83bb249aca1074f540445399ae0226c29737d0d4ebd447dcb43237b8f7
TLSH
T1A3D0A75758A28415006485011CE1F1442CD65699739288403CDEE15A0F59B9AC8C7D5C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1552	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{D9954F83-1AEC-4F77-8AED-441E07EB4A05}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3492	msedge.exe
3492	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 4220	2084	msedge.exe	88
PID 2084 wrote to memory of 1552	2084	msedge.exe	89
PID 2084 wrote to memory of 4272	2084	msedge.exe	90
PID 2084 wrote to memory of 4272	2084	msedge.exe	90
PID 2084 wrote to memory of 4272	2084	msedge.exe	90
PID 2084 wrote to memory of 3908	2084	msedge.exe	92
PID 2084 wrote to memory of 3908	2084	msedge.exe	92
PID 2084 wrote to memory of 4260	2084	msedge.exe	93
PID 2084 wrote to memory of 5112	2084	msedge.exe	94
PID 2084 wrote to memory of 4260	2084	msedge.exe	93
PID 2084 wrote to memory of 4260	2084	msedge.exe	93
PID 2084 wrote to memory of 5112	2084	msedge.exe	94
PID 2084 wrote to memory of 5112	2084	msedge.exe	94
PID 2084 wrote to memory of 644	2084	msedge.exe	95
PID 2084 wrote to memory of 3256	2084	msedge.exe	96
PID 2084 wrote to memory of 644	2084	msedge.exe	95
PID 2084 wrote to memory of 644	2084	msedge.exe	95
PID 2084 wrote to memory of 3256	2084	msedge.exe	96
PID 2084 wrote to memory of 3256	2084	msedge.exe	96
PID 2084 wrote to memory of 3644	2084	msedge.exe	102
PID 2084 wrote to memory of 1276	2084	msedge.exe	103
PID 2084 wrote to memory of 3644	2084	msedge.exe	102
PID 2084 wrote to memory of 1276	2084	msedge.exe	103
PID 2084 wrote to memory of 1228	2084	msedge.exe	105
PID 2084 wrote to memory of 5020	2084	msedge.exe	113
PID 2084 wrote to memory of 5020	2084	msedge.exe	113
PID 2084 wrote to memory of 1788	2084	msedge.exe	115
PID 2084 wrote to memory of 3776	2084	msedge.exe	116
PID 2084 wrote to memory of 3188	2084	msedge.exe	117
PID 2084 wrote to memory of 4396	2084	msedge.exe	126
PID 2084 wrote to memory of 4396	2084	msedge.exe	126
PID 2084 wrote to memory of 4696	2084	msedge.exe	129
PID 2084 wrote to memory of 4696	2084	msedge.exe	129
PID 2084 wrote to memory of 4696	2084	msedge.exe	129
PID 2084 wrote to memory of 2996	2084	msedge.exe	131
PID 2084 wrote to memory of 2996	2084	msedge.exe	131
PID 2084 wrote to memory of 2996	2084	msedge.exe	131
PID 2084 wrote to memory of 3492	2084	msedge.exe	133
PID 2084 wrote to memory of 620	2084	msedge.exe	134
PID 2084 wrote to memory of 620	2084	msedge.exe	134
PID 2084 wrote to memory of 620	2084	msedge.exe	134
PID 2084 wrote to memory of 4116	2084	msedge.exe	135
PID 2084 wrote to memory of 4116	2084	msedge.exe	135
PID 2084 wrote to memory of 4116	2084	msedge.exe	135
PID 2084 wrote to memory of 4448	2084	msedge.exe	136
PID 2084 wrote to memory of 4448	2084	msedge.exe	136
PID 2084 wrote to memory of 4448	2084	msedge.exe	136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\grupotenzo.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe280dc188,0x7ffe280dc194,0x7ffe280dc1a0
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,10326115324557688866,12608303585862289088,524288 --field-trial-handle=2328,i,6584784322155153870,12938206569162368032,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,4350645483344624219,11972623346390423749,262144 --field-trial-handle=2328,i,6584784322155153870,12938206569162368032,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,7110685448915199390,9282830262467947162,524288 --field-trial-handle=2328,i,6584784322155153870,12938206569162368032,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,12686403586387583460,15275382734918757487,2097152 --field-trial-handle=2328,i,6584784322155153870,12938206569162368032,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,5820991170652183668,3684405663525498675,2097152 --field-trial-handle=2328,i,6584784322155153870,12938206569162368032,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4124,i,932313543494889316,4282962535046389428,2097152 --field-trial-handle=2328,i,6584784322155153870,12938206569162368032,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,14792584300747154741,17662565195380781349,2097152 --field-trial-handle=2328,i,6584784322155153870,12938206569162368032,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,10137688113273485325,11941932007885066029,524288 --field-trial-handle=2328,i,6584784322155153870,12938206569162368032,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,12598265622320999069,7975570179769551060,524288 --field-trial-handle=2328,i,6584784322155153870,12938206569162368032,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,15028270782596183073,6480349096435038883,524288 --field-trial-handle=2328,i,6584784322155153870,12938206569162368032,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,15028270782596183073,6480349096435038883,524288 --field-trial-handle=2328,i,6584784322155153870,12938206569162368032,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,12466437443116220445,6863730570447812866,524288 --field-trial-handle=2328,i,6584784322155153870,12938206569162368032,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,16639937226555390861,10419268838975934780,524288 --field-trial-handle=2328,i,6584784322155153870,12938206569162368032,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,1500558070664262651,10943890433422193010,524288 --field-trial-handle=2328,i,6584784322155153870,12938206569162368032,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,9017791126893270745,9934729443312530458,524288 --field-trial-handle=2328,i,6584784322155153870,12938206569162368032,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2888,i,12578291578958667893,518798567603889105,524288 --field-trial-handle=2328,i,6584784322155153870,12938206569162368032,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5392,i,13605250729266121956,4954917921965590021,2097152 --field-trial-handle=2328,i,6584784322155153870,12938206569162368032,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3396,i,7428398189374374311,17030415143388526901,2097152 --field-trial-handle=2328,i,6584784322155153870,12938206569162368032,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7164,i,14537337837134854582,8801773028630660743,262144 --field-trial-handle=2328,i,6584784322155153870,12938206569162368032,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5552,i,18004346362664881612,8142503595409500866,2097152 --field-trial-handle=2328,i,6584784322155153870,12938206569162368032,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5208,i,2200725005734714174,12324338540284594527,2097152 --field-trial-handle=2328,i,6584784322155153870,12938206569162368032,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7112,i,13549392156372242991,18144829553811057133,2097152 --field-trial-handle=2328,i,6584784322155153870,12938206569162368032,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 fd7653fd212707a037134ae9a22bd2a29cd55ad1f0a5f2384dd793e98360280e
MD5 7fd3c08d70b21084834732eb3607d7bd
SHA1 f29bc605a66e35c6e1a3be17570f935b3fb01ecc
SHA512 765ccdf4202626686fb691bf9beb271b01c85c69fc7c88c5a0b53abe4ac6774ca0a39b227f4fda0d7765215d30590c850e12d780915f43750f21ea3912d072aa
SSDEEP 96:asIllM5RiuKi5uqL81WX46xKaE5W0x5gJJZqs1:IllmIuKRyrI6JE5W0x+nZn1
TLSH
T1FAB17373ADB0B016FBDDA9F447E022B23638D4E19E439E1D1064D8397C7AB9E1F64096
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bff5c07cc4f8fbf37bd4249d2c4c0f1e58666f567c9b672614bfa8327f0d70b0
MD5 c9bc9c9bb3935367574d5ae5924f896c
SHA1 27fe0217b6fe7d2d4fd8d080db28fdd22b9328ef
SHA512 db07d8397249c38a8def3069178983bdc6beff9a0abc75433535ecf595a14413103c48316f911154983c6b02a9b643d30e425bec05ba36a7108dedc89f630463
TLSH
T105618363F1D08016F7D87AB887E52697317CD9C1DB83EF520158D43DB84EB946A350D8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a865b8f890b08384100e51b7a148cf08f882da3dd21197845f61ade495a38a4e
MD5 e3fdc61754e400bdffa1634a2c84591d
SHA1 954d422eb15d031443a9afb0a0d83d43ae1f3935
SHA512 bb8fc93dc22fb8786d36b50382835bb02d0d34838d1f319d183facb60ae9e60206a7d2f8dbf01a3ae1da8764c54015250d5bd9a46562380f3860d2ba7ffaaf3b
TLSH
T122218BB3C7D9865EC91516F09A28EE2BCE2D050542183C1985D4EF6B93E3075E102A9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 210B
SHA256 8c9138c61e8ef6bad11a941e609c6c8504b4ad71c342842225a40acdf9986693
MD5 d3c529ed13f8be835118bf795f7ce926
SHA1 714aa86a01a419328dfb07005d2af16ac78fb153
SHA512 a81838cbc33c72db4bcd4fbb686c3ee9620b9761c3661cbc57f315466717a58880a4508aac29a86f1776aafad265084c8301ab4852668bd7d6fca3487cf6fb6a
TLSH
T1F3D02357130C3574695D7ED6C19DFCCEC7660054044299D812D1757D453349D454B051
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 5bc64d45698bb25a7952ea5fbc0bd1f9cc13b4b3a4d49263597d309a5069aaab
MD5 fe4299087cf15bfefcdd4061d05cf000
SHA1 6cf50cbea43332fe80deb60b8ff5cb35e61ca20a
SHA512 fffb70601a485990bc6036ea0d67e484e3daef76a8a5e69ff6ef2c39caffc1187465313ab133c96825691fb945e3dde308c20b2b7cd245dffb226c1d4d6895b3
TLSH
T133D0A76712082575796D2AC1815DBC8E836600241481999811D1A47A0525498468B151
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe597574.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe597574.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 bcc4232aa031ed5de9dfa6117ed51277cadfc2082f55a4065c86fe10f08fb06c
MD5 5487418c4b6ef63e9097b370381ae600
SHA1 1fe35fbc704c1022f65e0baf7bbd68039e68461e
SHA512 e1a0d8e4ae8f989767971fed5901dc310829284555bc91cb372512df45f0d02f01492ca76be5c66b1d27d64bc14de11642605fd1a6160ff24f7711c9f3e5a3bb
SSDEEP 192:sxZyRlWU/fQs9nIdpdPHW6+WNGY3RK0IgrJ:sxZyaU/fQs9oZHbGA9
TLSH
T13122B6126E28A57B8CC7D21DBB257F53E6F95032A5941E58BAFC851C04E66CE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 dae304014ac3c4e90cfd7bcc435b3b70802587ba310ab11345b778ecd4a51f32
MD5 a78f2d710ba371b93f4d14b4c9f066f8
SHA1 9b59911fac029723aaefd3861e4f24545b2ba86e
SHA512 ca0dd7da2b9fa71f59edddb58c6e8c9c576e0bb1e5cf099738cf7919819b93cbb8480f6dee23f4d72f1d85f69f8cea29b926aebec9fa9dfef67430a97cdda6c3
SSDEEP 192:sxZyRlWU/fQsTnIdpHPHW6+WNGY34K0Ig5AJ:sxZyaU/fQsTovHbGJi
TLSH
T1EE22B8526E68697B8CC7E21DBB257F53E6F9503295901E48B6FCC61C05E76CE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 105c3e724ac8733ecccd00accf33d07b368335ecf608ee03dae59cc3cf6a0756
MD5 198aab35dd22f7da27c9c3f220fe71ea
SHA1 17bf40b5ccb87da3876892bc1215c40dad35d144
SHA512 fafed58cca2a4ed208b1de22a4b515d851e07b6b46d8750a083a1b2be02ad32f5a154e1994122d108e1534259ef38b81070ff3469fe2383ada519abbc19f3886
SSDEEP 384:sxZyw2mzU/fQsT0IkkBMHEmpwMRxFnCHbF5BkLm4p/HVzkkcOSsK:saDmzU/f/0MM5t3FnCHbF5B6mYHKOo
TLSH
T1CB82B7A26924D5A7CCC69C0C7F35BF25D7E608A2CC914D9C9EFCC91904AE1FD6A0AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 16f98f3900d0921a32ac1bb87d6815199b372e7009756d3c93bc61a5dd5909be
MD5 047232f3b572556e49624bcc2be9db90
SHA1 f3c0620a4df9566363daba9251fbce6bb8718459
SHA512 5b9b43851a5b073b459410be7cea9ae29a81c83e49609eb7e885669c23cfeb29e5f11239cfd78fedda090487732a78a61854d39b584b23da53382e16557e4ce8
SSDEEP 192:sxZyRlWU/fQsTnIdpdPHW6+WNGY3/K0Ig5AJ:sxZyaU/fQsToZHbGwi
TLSH
T11822B7126E68697B8CC7E20DBB257F53E6F9503291901E58B6FC861C05E66CE2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 52e361beb9ddcff7ab9503c6168772e6d493cee1e72a006ae1f337dd77d16b86
MD5 b7840c3cfd6be7ecfa49054523f3290f
SHA1 8d48cd390b5d0a19c294b009354b366a4d23cf5a
SHA512 19ef2e3c2f637f1d7f2330d1e201a327211e9234619c0b3d0434ef805ac82bfec2b965f5510b9a6975f359fed33775f0ab10747377b889e7737131e9067b6dcf
SSDEEP 192:sxZyRlWU/fQsFnIdpdPHW6+WNGY3RK0Ig5qJ:sxZyaU/fQsFoZHbGA4
TLSH
T13622B7126E78A97B8CC7D21DBB257F53E6F9503291901E58BAFC961C05E66CE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 0a3212b62abc327aab20207138cd410664cac6e410514e2038bad8e3503df002
MD5 59510ceef1c2bc22ad880a835ef6ff6a
SHA1 a28a669c17787b4931e6b463ab94cac2857e81dc
SHA512 13ab827fc791e277fd7bbd0d31ae15d016b9b5f1d4fb28d698656b3223c032a5e0bf88701e70dad91cfe29d169353f2e58d76af177f8d7e1d2924f714b672b46
SSDEEP 384:sxZyamzU/fQsTckkBMHEmpwMRmHbo/HzkkcOSsK:saamzU/f/IM5tMHb6sOo
TLSH
T1EC82A7A26924D4A7CC869C0C7F35BF25D7E618B28C910D9C9EFCC51904AE1FD6A1BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 5d92af7a3c8c6e59affcafc2fcaedeee8371d51faec5117a8ea0dc1c82b23798
MD5 1c12035bdd401f5d6037df1daa9e4e72
SHA1 0d1a72d11a82caad3fe038634e2eb6fccffd4032
SHA512 52fea9072afc9fe09f47f05ba6927c91060cb047477767474d20e6dd5b2dcfc03874f7abb4094b30c2b37f843ea91c205f66db1901f4e8754cf48fa273ec5625
SSDEEP 768:+i30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72RrolZMU3:+i30AbSWvS2l9u1jaLmLZ12qZ3
TLSH
T199C2DA3B640CCB7E4FC01A9DDC6AAF9B6E9C02C796648D4047FA984C02C77EA91174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4f3a185e-5bc2-4345-ae38-581f252b2759\index-dir\the-real-index
Size 552B
SHA256 40e36da2073c4468376967b9c75bdd4220d6ac6a7d7ef657c30c3bc4d28a63f2
MD5 3765ee8b8c26620460a1e3cd98d07ea8
SHA1 728522763a04985717f18dcca02adfeff9be81d9
SHA512 9e2b7fefc2a3b9fc45a7925a469a1775e24a4bd718e1623a935a80a1746d01aa019f2d24a6edba5751896b595a726e30359136c998039228044122c850bb417b
TLSH
T156F0F1DB3D138606FC584235307D746169B152DC53902E0FB0FCC0259C96788DE406A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5af9c3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4f3a185e-5bc2-4345-ae38-581f252b2759\index-dir\the-real-index~RFe5af9c3.TMP
Size 552B
SHA256 af0cf7bb0aa2c2043dbc2f0486942dbb6e9f6936a1e25b0a1ec0a0095bb62059
MD5 a5c0c78bf53ef067f8d1c9194484874e
SHA1 ba81ce89e6c6578f12db708228ab6ef309226a3c
SHA512 183b0eeec7bc638ade23a56cb8cb24e4564a8dae2c0b2fdc00783c030304e452be7e3d4510f157de9da93e3f29af2d2990258d94f4fcea787fc3c6815e58b8b0
TLSH
T1AFF0F1D851134B46FC080231A57E615561A1500893103A4FB1E68064CC42780DD82BF5
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e594eddd3ffbb6b07ea789f2759c4a6729a60e5789b5c2d38b1eae77c7eec3dd
MD5 dee600546038b1d2c2436e91d78cb3bd
SHA1 57904872c6a2bcfee471d327362da0361b545d6c
SHA512 5df5ba109d15de18ab7dba2fa65e6072418ad8d6db329b0ebb8d4f28008558ed4b719f126ebd69aea0dea13cfeadda97d86bea8a2013706f60f93f627f4aa6a5
SSDEEP 96:Kh4rk4iqqOI6FViYOK67i+OmAYdOIPPZY/DRT/zIveCiLzK6qitzmJhW3ujWKcI3:AdXmF+
TLSH
T1AF91F085357B02103C7D295D92B8A65E166131B23018FB2B7FBD05B69F2BE180DFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59a510.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59a510.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 aff37775eb48de67b87a697571318962a6ca90bc85e27d2da8605daeffeb40bb
MD5 c053475da72b24a1910496e3a6fa706a
SHA1 027a373d9040966976e5803bb56f0e29d70a35e4
SHA512 2fb1ada9376d3db4c9dbd425da1ff264737671ef121ae08c16f271c1942055bc6a26ea9cf8c0760180155f6c2b764349ed8969ba161d0e6cada92a75f16b4946
SSDEEP 384:3ZcIhsNgFDfGpuVnEE49iX5F+JORatgOIwZOyW+oC:/h5GJE8aiJ2aXsiB
TLSH
T1AE827C3288B85DBA5CE7D145F14A36039FB89067D7D4AF9499FC6B2C02E7594130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 101aa860f4c35f283477edfef431367d1a6894a6d14f9c50e17ff936524849a0
MD5 3d30b9e9e527ccdcd1c18a86d2388903
SHA1 2bc1df782f7121bbd3e074234d13f779686059c1
SHA512 bcb8957699c43bda3fb8844b797c0e73a382657a3a85c9297301500e26188124e9ceb1f129212ff84d2bad8795a378acbc8fa2921e9870007957df37be343f75
SSDEEP 384:hiFiZcIlzsNg8TUNTUlIlQDfGpuVn7E49iX5F+JOWatgOIwZOyW+oC:IFQdBwgWGqE8aiJvaXsiB
TLSH
T170A26C7388E89D7F9DE79A45F54A32039FB45067CAD4EA94D6EC6B2C01A70D8130BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ea367ee8a122ea6690ae0352ab384bfed6c82bf4605ab357e7a68728b42c2f4a
MD5 5f4929bfbe0210ae835f7eac57b16b30
SHA1 d217c21cf9ac4e90f9e262fdfc67dfa82c789976
SHA512 5e3bfa1975b2b65049c517395d691fc05ff3802d8970eebacccc9fb1902058187a6cff3f3b50581890cb19ce7afad67bc0eed68c95ff3f4ddbb236c92225a7fc
SSDEEP 192:LON96AmwprQmiUy3J6siX5FbyhjkQJiuurU6:LON96ipd26siX5F+JwDU6
TLSH
T16F02D835EC686C7B8EF3AE19B58636136FA5116BDA946F44CAE81B2C01D768C1307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 30410f472291eb6cd6bd1f3d335346b02391ebfdb5c37d83f5c9a97533f59705
MD5 a8065f608121864f46220ba157816f04
SHA1 efa21ac12ac9a8ee2feb9c1c358445d326d867b9
SHA512 e4ac4c98771b99282815aca3a95d6dc475388f97eb3438ff628d0109872792144a605be622872cce9e55a7f13e90365d40e80ae4cbc9ab936de9118247dc0f3d
SSDEEP 192:LONp6AmwpvQmiUyYJfsiX5FbyhjkzEe+fGlRqqyU6:LONp6ipx/fsiX5F+JOzaU6
TLSH
T1D7121936A8B86C7B4D93E564B04735139EA45167DB88AF44D9EC2B2C02EB59C530B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 bd7ec2d80d2fe586577f55b43c5c3c682f86e1ca938fffca434c0242e3372739
MD5 e36199e150f699b066d2e2276aa1e36e
SHA1 81efe4eb80a17b42f2d3216d55d15c478aba4e14
SHA512 15c6b60152c606aa4e06487c06c06b2fc25acf0427b2be47afea61302b34845999ac50bb09512d4791f9add9de19fdbab56ed14b534f0c956745758d787bb4e7
SSDEEP 384:lZcIhsNgQDfGpuVn7E49iX5F+JORatgOIwZOyW+oC:dhgGqE8aiJ2aXsiB
TLSH
T176828D3288B85DBA5CE7E105F14A32039FB89067D7C8AF9499FC6B2C02E7594130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c3099c58f74858e0e957872a55bb5272f283ef8eca74d5f50ad29dd3a944f7fd
MD5 6683577effdfdf1f14af800993f57fa0
SHA1 66a649cb678665f0eb309d4d078e073d962d77b8
SHA512 5445bb7b1795789bbc101539d8b6f1963c49a6a25cbeff2e90b80308dda4a311f046ff039444619c453a2dceba622b01a3bdc7f517881e57764f653df569e5e3
TLSH
T1A3E00242D2100672C01C0330109B661025F2811402B3438D5510817876133046D50B42
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5ae272.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5ae272.TMP
Size 392B
SHA256 446de03655867bbf588f9907425579e41f15ea61ac4f34b5b4051a6bc19d749b
MD5 b4375946b90a12e09ab00713c661aacc
SHA1 a5e96694eb1b1322e7dad5f6a9e08d5fe5cb497a
SHA512 e35869f7fbdedc8ba6e86205fc7ccc0fc900e05617644f7ed0caf062fcb556ac44b04c078108f26cff6c6d970ca806085f2c1307fa230a57bd3eea5bdb6a783b
MD5 SHA1 SHA512

Submit Download

e2708f7e-171c-478d-aa57-47416676424d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e2708f7e-171c-478d-aa57-47416676424d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a41427869da4f4ddaa6450aa0b61fbb2b89987fc903f0f6a16836479e5342fb5
MD5 3ab3cc111c030fdb3a33e2ea0563add3
SHA1 fd8f48a9a5fb18742381e801d8397a558b7bb161
SHA512 d8d3f04d30d0c515ca35f778c231af02f24de78a038e9e893176cebcdc0a1f8abca4047c2b7a8fde0785591cd1be77e90080eabee2c13d524cdedd502fe89262
TLSH
T17F41285CAAFE1104F3B3AE5A9BF7646E087A79372E1BD59D00110E4E0722E44C871737
MD5 SHA1 SHA512 TLSH

Submit Download