hxxps://the2point[.]com/mspublication-manual-storageaccess-automation

Analysis

user interaction
yes
max time kernel
299s
max time network
303s
platform
windows10-2004_x64
resource
win10v2004-20260911-es
resource tags

arch:x64arch:x86image:win10v2004-20260911-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
02/10/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://the2point.com/mspublication-manual-storageaccess-automation
Sample261002-ph4anatt9p

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL 3 IoCs

phishing

description	flow	ioc	pid	Process	stream
Email address	79	[email protected]	4720	msedge.exe	1
Email address	79	[email protected]	4720	msedge.exe	3
Email address	79	[email protected]	4720	msedge.exe	9

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4720	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{9536BB83-5B66-4E18-B793-7CAEB9EA2860}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5764	msedge.exe
5764	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 3548	2848	msedge.exe	88
PID 2848 wrote to memory of 4720	2848	msedge.exe	89
PID 2848 wrote to memory of 824	2848	msedge.exe	90
PID 2848 wrote to memory of 824	2848	msedge.exe	90
PID 2848 wrote to memory of 824	2848	msedge.exe	90
PID 2848 wrote to memory of 3192	2848	msedge.exe	91
PID 2848 wrote to memory of 3192	2848	msedge.exe	91
PID 2848 wrote to memory of 3660	2848	msedge.exe	93
PID 2848 wrote to memory of 3660	2848	msedge.exe	93
PID 2848 wrote to memory of 3660	2848	msedge.exe	93
PID 2848 wrote to memory of 4208	2848	msedge.exe	94
PID 2848 wrote to memory of 4208	2848	msedge.exe	94
PID 2848 wrote to memory of 4208	2848	msedge.exe	94
PID 2848 wrote to memory of 208	2848	msedge.exe	95
PID 2848 wrote to memory of 208	2848	msedge.exe	95
PID 2848 wrote to memory of 208	2848	msedge.exe	95
PID 2848 wrote to memory of 204	2848	msedge.exe	96
PID 2848 wrote to memory of 204	2848	msedge.exe	96
PID 2848 wrote to memory of 204	2848	msedge.exe	96
PID 2848 wrote to memory of 4936	2848	msedge.exe	100
PID 2848 wrote to memory of 3936	2848	msedge.exe	101
PID 2848 wrote to memory of 4936	2848	msedge.exe	100
PID 2848 wrote to memory of 3936	2848	msedge.exe	101
PID 2848 wrote to memory of 4140	2848	msedge.exe	103
PID 2848 wrote to memory of 3640	2848	msedge.exe	114
PID 2848 wrote to memory of 3640	2848	msedge.exe	114
PID 2848 wrote to memory of 3640	2848	msedge.exe	114
PID 2848 wrote to memory of 2012	2848	msedge.exe	115
PID 2848 wrote to memory of 2012	2848	msedge.exe	115
PID 2848 wrote to memory of 2012	2848	msedge.exe	115
PID 2848 wrote to memory of 4440	2848	msedge.exe	116
PID 2848 wrote to memory of 4440	2848	msedge.exe	116
PID 2848 wrote to memory of 4440	2848	msedge.exe	116
PID 2848 wrote to memory of 5444	2848	msedge.exe	118
PID 2848 wrote to memory of 5452	2848	msedge.exe	119
PID 2848 wrote to memory of 5460	2848	msedge.exe	120
PID 2848 wrote to memory of 5488	2848	msedge.exe	128
PID 2848 wrote to memory of 5488	2848	msedge.exe	128
PID 2848 wrote to memory of 5764	2848	msedge.exe	130
PID 2848 wrote to memory of 2684	2848	msedge.exe	131
PID 2848 wrote to memory of 2684	2848	msedge.exe	131
PID 2848 wrote to memory of 1656	2848	msedge.exe	132
PID 2848 wrote to memory of 1656	2848	msedge.exe	132
PID 2848 wrote to memory of 1636	2848	msedge.exe	133
PID 2848 wrote to memory of 1636	2848	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://the2point.com/mspublication-manual-storageaccess-automation
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff9647fc188,0x7ff9647fc194,0x7ff9647fc1a0
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,6840096330370733629,9205580016945587156,524288 --field-trial-handle=2040,i,17611582466934754791,13333893710896298721,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:3
  2⤵
  - A potential corporate email address has been identified in the URL
  - System Time Discovery
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,425732747245148293,731779292602151356,262144 --field-trial-handle=2040,i,17611582466934754791,13333893710896298721,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,10260308869301493061,2653361661051011330,524288 --field-trial-handle=2040,i,17611582466934754791,13333893710896298721,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,7738137065922798783,15803073238575408182,2097152 --field-trial-handle=2040,i,17611582466934754791,13333893710896298721,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,9612830904612893365,9067085301905860463,2097152 --field-trial-handle=2040,i,17611582466934754791,13333893710896298721,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,13896052062599896174,16603042166504965440,2097152 --field-trial-handle=2040,i,17611582466934754791,13333893710896298721,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,12652593567189431850,3119030925905995853,2097152 --field-trial-handle=2040,i,17611582466934754791,13333893710896298721,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:2
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,6532514149111460182,9455024899012799333,524288 --field-trial-handle=2040,i,17611582466934754791,13333893710896298721,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,4345369659007163438,14110807113998423462,524288 --field-trial-handle=2040,i,17611582466934754791,13333893710896298721,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,15586174990634379663,7447683911213100921,524288 --field-trial-handle=2040,i,17611582466934754791,13333893710896298721,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,15586174990634379663,7447683911213100921,524288 --field-trial-handle=2040,i,17611582466934754791,13333893710896298721,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6256,i,8142885662190198703,15693729281754129982,2097152 --field-trial-handle=2040,i,17611582466934754791,13333893710896298721,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6532,i,11262122033653067013,4258973528291294258,2097152 --field-trial-handle=2040,i,17611582466934754791,13333893710896298721,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6672,i,510691598905922551,656609713820871901,2097152 --field-trial-handle=2040,i,17611582466934754791,13333893710896298721,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7404,i,381864598545470478,3138169174191440419,524288 --field-trial-handle=2040,i,17611582466934754791,13333893710896298721,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:8
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7376,i,16124995853759957604,15268126788336640968,524288 --field-trial-handle=2040,i,17611582466934754791,13333893710896298721,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:8
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7364,i,6035313669869305052,16745124240258761065,524288 --field-trial-handle=2040,i,17611582466934754791,13333893710896298721,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:8
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,11925737609834774048,16055765083444541194,524288 --field-trial-handle=2040,i,17611582466934754791,13333893710896298721,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=756,i,1609531658009526595,11653476909393437975,262144 --field-trial-handle=2040,i,17611582466934754791,13333893710896298721,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3932,i,15967990109161228915,12135512516171733057,524288 --field-trial-handle=2040,i,17611582466934754791,13333893710896298721,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,13498682320103644764,7954504814397347036,524288 --field-trial-handle=2040,i,17611582466934754791,13333893710896298721,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,17419553862541053562,15445036589466425687,524288 --field-trial-handle=2040,i,17611582466934754791,13333893710896298721,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:8
  2⤵
  PID:1636

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0e1d0fdd-b0da-4dcd-b072-2c6a42506a34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0e1d0fdd-b0da-4dcd-b072-2c6a42506a34.tmp
Size 8KB
SHA256 76589814b5bfe808112b6b04c51456362aa6701b122ca68fd0175c238c1279ef
MD5 df52408a2171f3f1a3bf2edbdafc5d0d
SHA1 0ab4e8ed8162716c632011e52ad177f50e1f4da8
SHA512 306f4beaf3986be52f3d14aab290245b7246bb6352708148c98facf2dfd5d3c2267552150555a0ead8d988ca9667b95f65886c5b4bab22b933314944741d8780
SSDEEP 192:LONM6AmwpnQmiUyBIqsiX5FEs67ZlR5qLU6:LONM6ipJbqsiX5FEsAiU6
TLSH
T1CF124C35A874BC7B4DD2A552F08735135EE9421BEB487F94C9EC271C06EF198930B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94ffd53e-5262-4b0a-9e74-6029e0cf1053.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\94ffd53e-5262-4b0a-9e74-6029e0cf1053.tmp
Size 8KB
SHA256 69b20abbdc174c4f58d49ae5626bdae4f735b2d240d0f5f031cd60daec6351fa
MD5 e38088e7e68f672f2dcd0d1131b637c2
SHA1 159435390080ec39389c9fed870a73015c828de1
SHA512 63ee3d9f9d6201bd83a18acba7a0aaa0174f7a9149b309c11938c2fa903690c098f13133d3a2f674f0a4fa7fcedb2b997009f679aedb9e63b3daed1411266e2d
SSDEEP 96:gqONk1QsjpfuMVwptaL5ih/cIPURHl8h4otop5kiCDkBIPuva6zx8X5Fxbv2eYvo:LON16AmwprQmiUycI6siX5FEPJixzU6
TLSH
T19502FA35AC786CBB8DE2AE45B18B77135FE5116BEA942F44C9E8171C01D769C1307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

3405cb74-5f1a-4d01-a357-3684a953f8c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3405cb74-5f1a-4d01-a357-3684a953f8c5.tmp
Size 10KB
SHA256 8aa86ab40b649f251ceadcdfb6f4607a279691eb5b010aa43f319b19a2749943
MD5 2e05161985d6f3dbfcde707dc565cf69
SHA1 f1f591d2d39f18f660c2934a7d4ef2e4757aebb7
SHA512 dac2bbd6d5f486e70cf805246f12a1f881f907de74107cd448970c227ba50bdce4001c2153db60837a9445c794c55271e12f09d53fedc0a2dfd4ebc5c9189fcb
SSDEEP 192:sxZegRWa/fvs7wKIupPKHW6+WNET8/Y3KObIgUoJ:sxZegoa/fvs0KyHbR/GUM
TLSH
T1E822C7126E28657B8CCBE21ABB55BB53E2F94032A4D11E48FBFC861C04E76DD221740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4303f686-d4fc-4b02-b7f0-06e9d47e036f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4303f686-d4fc-4b02-b7f0-06e9d47e036f.tmp
Size 27KB
SHA256 243b56a23d10212d0ed744e71b44b606baa3d38b838bef76e75a3705777b02c5
MD5 87498596a3d2d0da58eb6ed4713c7f3a
SHA1 a1635e0cdb5bb127e3fd1b145881586530ac9d55
SHA512 258847fc930054f9d32ae4817c76cac549acf10e32d7aa8cd55b0b44c2f3a301022206314fb7e08674b3354485eca3d0621bdaa77c453aed9aacffda24497224
SSDEEP 768:FnOC30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72ORrolZMn:FnOC30AbSWvS2l9u1jaLmLZ12OqQ
TLSH
T1DAC2DA3B640CCB7E4FC05A9DDC6AAF9B6E9C02C796648D4047FA984C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9727baa9-7c8d-403a-8ed7-481611fbf376.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9727baa9-7c8d-403a-8ed7-481611fbf376.tmp
Size 10KB
SHA256 cdc270d8c78689577954048c985ef2f0d55bee71f67a7543cf60ce6f62bdb102
MD5 d31002c2240e04475db20b7ad1035c0c
SHA1 f7931e5b613600baabc75d6032ae58c46e586796
SHA512 8416c9a3b86d3a34cad32a040533319cd7864a66a08b0b905ec60a483aa5d7c3f59feaba4440c1d8856ac9301d842864736a9d978e3caacae25665e3790ccd26
SSDEEP 192:sxZe6RWa/fvssKBwdIuptAKHW6+WNqPC1ZLYXY3SObIg5aoJ:sxZe6oa/fvssJRJHbq61eXCIM
TLSH
T18222B8126E38657B4CCBE219BB55BB53E2F9413260D01E88EBFC952C04E76DD221740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 61a991f4ef4b38c5b215a24c20239805980421aba7ba36e02ac6f147312240e9
MD5 b24456b0ec79b8184a37be054ec7dfad
SHA1 14d044165ae7e6342ae5ca360eaf85c0c66f097d
SHA512 82f64c6693cccc1d7f9bf69e9fa6911ed518370c9a41a51cbcf9db863b39e943560115b5c0bd4390944ab0a900f65930e0afab1df7b77c354495402e5c4bb8c1
TLSH
T148E026ED08DAC62EA308688B516C934CCF813B1F93C069AE1B04CDC97405458B2C67A4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 cd390a77cc91b832bd70ea19993640d128956b21c36878cceea7ba32030c66f8
MD5 84c67d003d751e925046131c9eecedf4
SHA1 87ecfe971447da47aa222073dcd6378a7c60c211
SHA512 eef1c70f273dfd6f6c5e963dd8247af8ec002427dfb6cb60a508441a3a4d1c038da41e8b953e7e5b7d52134253e560e66149c8588a76750b6012df7e32640fb9
TLSH
T18D61709E1EA0486DE79F727159D0998BB37443F11EC73E131680E179AF3636101AC6D7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d95a488d92e9f7735fe1fd283e3a06fdd7d99bcb4173ead92272b179d0c4ca57
MD5 d0421537adccb1312d117468df474a54
SHA1 a79c31ddff1d4a494945cb235ce97df7c467c553
SHA512 24ad8ff01d8666972587e432c808d3b47358e6168d918970bd549744fd169b9fc4734b0a6a95320fdb0a8843e1f5d2f337f8a4fe93cb75579320567cefed9ffb
TLSH
T1D861818E2E90486CE79F617199E09A8BB33043F51EC73E131680E1799F3633201AC2D7
MD5 SHA1 SHA512 TLSH

Submit Download

8c62f10f-2fac-41a1-8551-5f1fb8b8b0e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\8c62f10f-2fac-41a1-8551-5f1fb8b8b0e1.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1bd955a3-5e92-4cf9-b1c1-262e67983d24.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1bd955a3-5e92-4cf9-b1c1-262e67983d24.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

3ceb615f-ca4b-4f34-aad6-27f438b3b3d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3ceb615f-ca4b-4f34-aad6-27f438b3b3d0.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

e35f3941-d1ca-4e95-bb55-25076bd0226d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e35f3941-d1ca-4e95-bb55-25076bd0226d.tmp
Size 4KB
SHA256 e3716475f8d41c5930a4a2e5084b9f3dac632079462c14ef448d244bf57a8b42
MD5 e2140e775d1e2397ab0f641ff1fad5bf
SHA1 8115ae2c2fd2736a7ce41357d29186edc10a91c1
SHA512 3b09bd13192920068fdff4e1fc2fcf5f73f7ef15c1dc1959feb846ee024e65f216f63aeaf4b5e04eb03a28aa3c96fdfbf02b675493afc2a058ff5637d08b144a
SSDEEP 96:DaohoTo7oboB2VCmrolo7o5ouo1coFoioMZoUokooBqwQ:Da0aU2M2VCmrau89CceZZPfNqT
TLSH
T1C7A1DAF383E6966DDA1116F06A146E2BCE5C0815431C3C6AC9D9EF5FD3F28B0E14164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 729B
SHA256 df9d208cd61d3c6a1158d2d8a905b3b6f40bcb18e08502e456e1a63941eab956
MD5 248e592c683a1098a4da44603f71776d
SHA1 a82114c9e73207178ce2863967638fae27925b02
SHA512 5b53ac59e550192c7d1977e5263d1598a0e03fd1055ac938bccb9ad5b752a27c57e98b5c4397d01c6fad24bf25387575ba4cb1e98c44eb7be277cdd08037626f
TLSH
T15D01AD4EB429715034BD368482DC8417C65161BF72AC64DE3EE58AD24E3BE009AF8DC9
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 904B
SHA256 9be9fe71a377cec0deffbd4c0b65e1dc8e585880853fbe7d3494289b9f55d1e1
MD5 bf0f2a5ce95cd28bde0cf2e7e5a004bf
SHA1 38a9e8675571125ad46bdf327efd44d93ba1ca57
SHA512 070d092386af4172b741e6d1e9c76dfd4d4598831b33cd9f4abd8b4ceab3b5e83907c82fdbd48516073501233b5c4e7c1404f996bdaf00a24f1fe9389451a571
TLSH
T194118C4EA42A715038BD368482DC8417C65161AB726C649E3EE589D64F3BE009EF89C9
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

a1d25118-001f-4c60-9030-3f4b9eccd6a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a1d25118-001f-4c60-9030-3f4b9eccd6a0.tmp
Size 10KB
SHA256 e5720444ad8a8cf9e2dd43cabc548a8e0d95083dfd2456f48cf1c93d7cd5611a
MD5 0a2fda0d14869f2134c65fe67c1d719c
SHA1 63c0bbf92c279d3ad9dc0775dcf9c4b48a5ea557
SHA512 2dff8074c3a5b4e534aa6f61c5fa03afe68e24214389ae7de48a90192f058b60b736e9ea0468be3826215c8f959d23712ccb533a265c177853dafb2c29c22cb3
SSDEEP 192:sxZe6RWa/fvssK6w7IuptIKHW6+WNqPC1PUb3LYXY3oObIg50oJ:sxZe6oa/fvssan9Hbq61csX0GM
TLSH
T1EC32B8526E38657B4CCFE21ABB55BB12E2F9413254D11E48EBFC8A2C04E76DD221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b244d2a5-9ac3-451e-b7ec-7e9d4fc13f1c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b244d2a5-9ac3-451e-b7ec-7e9d4fc13f1c.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1081d3f3-a870-4464-9752-0cee0ce3f7b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1081d3f3-a870-4464-9752-0cee0ce3f7b1.tmp
Size 22KB
SHA256 e7dfcd2af3cefc7ce57f7bf6991d35a5d20958cb42766f953d9e1c76fae333b6
MD5 5cb2b7e81b4702abd9866dd283d10b96
SHA1 5384d524ca48437435a367dbbc158070ce70493b
SHA512 c5558f99f45f9b2e4cc7c7fd80211556401a16d808a8b34aaccf6cba23f5b5a5e834235a19cf251015bda0baa50c8bea1b0a20624e7e483f5a039e0d86134f85
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uQ:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAZ
TLSH
T168A2B81DC81C7E3257CA2F7D6A2F9DB276CA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

b739c92d-35d9-4422-882c-46925659a280.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b739c92d-35d9-4422-882c-46925659a280.tmp
Size 26KB
SHA256 3667b4821ae6c37bee60c8cd7dbd3b24fb561f0c371aaa2d3fd8bfaa3776ce3e
MD5 3b1bf6f4b3cf8e3e6c7f852566953335
SHA1 ef9ca823b019b00fbfe8cf3798ca9c037f553665
SHA512 7b7e34994607d87281f2d0e8383a200f8235cb261fb8eb379326d7389f3284efd61550082087c991d41ec96a4cb0bf1492e97118767ad304d89cd68ce344318f
SSDEEP 384:Z67FiZcIDzsNr8TUNTUlIlaMojhSpu+PHu9iX5FEsJitgOIwZOyALJoU:wFQHKwgpoNSh6adiXszF/
TLSH
T124C218F248E7987AD8AE5743B37E3D034EBCC157B684AA54B798561CCC960BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb45f30c-5cb2-47af-8d04-12b288749539.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cb45f30c-5cb2-47af-8d04-12b288749539.tmp
Size 18KB
SHA256 d1f347053f1715b6803dac398033f0a4552c0c917c32e90e27e7e7a2512ccc99
MD5 45f99cc39289dfca3c1866d0ee3c7e3c
SHA1 9726bf1e394761f1b2c131d2873ef8e440312b77
SHA512 a1889e6f56bd5f4c8db393dcd0e7ce3db2ade952228b1357cdffadd808321835205e092b9c657ec4b1c9bd65a60799ceab6516e314b061832edb24852c745a5c
SSDEEP 384:MZcIhsNJaMojhSpu+6Hu9iX5FEsyitgOIwZOyALJoU:ahAoNSQ6aOiXszF/
TLSH
T1CD829E3298746CBB5CFBA151F18B76035EB8816BE7C8AF94D5ED631C05DA194030BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5f5c38d-2524-4f54-a39d-bcd6aa691518.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e5f5c38d-2524-4f54-a39d-bcd6aa691518.tmp
Size 18KB
SHA256 42c3316778f25f09da15cfb7ab283a118b54548465907f6c892e4929bfa0982a
MD5 002dc36c7f9d6040f6328983945bd7ef
SHA1 3c9f08f6f52b5c8a46356b79bf7c264e8bfb0b91
SHA512 3f2caa2fc63b120a8976ce81d847ddd9b7564b9707d2aacdac9b0af0b7d23c27c87a9d0839a735d531277a550d8de94a639119b19d81a2dc7ebc44f707e270cf
SSDEEP 384:EZcIhsNJaMojhSpu+6Hu9iX5FEsyitgOIwZOyALJoU:ihAoNSQ6aOiXszF/
TLSH
T194828E3298786CBB5CFBA151F18B36035EB8816BE7C8AF94D5ED631C05EA194030BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d10c055-6f4a-461f-9f3f-7d4e5edc9527.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1d10c055-6f4a-461f-9f3f-7d4e5edc9527.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 de9b7a5991c562570792e39b9467aa496628817136170ab627d5a437483bd682
MD5 269f1de44f1067a6c325c5ebdfe0774d
SHA1 18cedc09e7c847b38998044a1f7bb66b267b3c71
SHA512 71faa3014d7b7271bd35c7009a14a250c249ca1a23a96dfa679f5f31c63717141bcfc2a72ed9be73962cd6f212eb6d650cb1c9d34af34ae10f4dbddfbae781a5
TLSH
T12D41D758A7E91148B3777F5AABF7A86D447FB8372E07909D10110E4E0A63B40D972B37
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download