529e09cc04ebdca3dba18d1e245610d82b098c9563d7dbf9eedea71dc5b1744a

Analysis

max time kernel
898s
max time network
734s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 17:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Oficio_247_CIF_SENASP_MJ.html
Size 32KB
Sample261009-vppnqsda32
SHA256 529e09cc04ebdca3dba18d1e245610d82b098c9563d7dbf9eedea71dc5b1744a
MD5 06cb3c150b6d029950a0afed666cffb9
SHA1 234a803e6c01e4a59e8cbe5ca0454668f5f2a1da
SHA512 b55200a7b1e2a593017120fa5af81100e8a7d59c3a5e36cf67816c2b951d23ca2e7521de2ff500eff48a253b3341475e0c75b707974fdb068aaa358d3677a141
SSDEEP 768:cgOfa6BnCJmdYZUc5Ne5VXq9kI5UGzHaZjkcea5yIuyULyxCFD1bjBK21:WftCsmhrYO/5hec2xCJ18m
TLSH
T102E2AE2487C2110620F34364BB668F17F352C907A60BD152B7FC9B5AAFE6950DE17B98
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
256	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{7C343D06-4031-4B0C-B650-C155947E67C5}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5340	msedge.exe
5340	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 1952	4068	msedge.exe	90
PID 4068 wrote to memory of 4072	4068	msedge.exe	91
PID 4068 wrote to memory of 256	4068	msedge.exe	92
PID 4068 wrote to memory of 4072	4068	msedge.exe	91
PID 4068 wrote to memory of 4072	4068	msedge.exe	91
PID 4068 wrote to memory of 5640	4068	msedge.exe	93
PID 4068 wrote to memory of 5640	4068	msedge.exe	93
PID 4068 wrote to memory of 2052	4068	msedge.exe	95
PID 4068 wrote to memory of 1452	4068	msedge.exe	96
PID 4068 wrote to memory of 2052	4068	msedge.exe	95
PID 4068 wrote to memory of 2052	4068	msedge.exe	95
PID 4068 wrote to memory of 1452	4068	msedge.exe	96
PID 4068 wrote to memory of 1452	4068	msedge.exe	96
PID 4068 wrote to memory of 5176	4068	msedge.exe	97
PID 4068 wrote to memory of 2108	4068	msedge.exe	98
PID 4068 wrote to memory of 5176	4068	msedge.exe	97
PID 4068 wrote to memory of 5176	4068	msedge.exe	97
PID 4068 wrote to memory of 2108	4068	msedge.exe	98
PID 4068 wrote to memory of 2108	4068	msedge.exe	98
PID 4068 wrote to memory of 5820	4068	msedge.exe	100
PID 4068 wrote to memory of 4900	4068	msedge.exe	101
PID 4068 wrote to memory of 5820	4068	msedge.exe	100
PID 4068 wrote to memory of 4900	4068	msedge.exe	101
PID 4068 wrote to memory of 2500	4068	msedge.exe	103
PID 4068 wrote to memory of 5076	4068	msedge.exe	107
PID 4068 wrote to memory of 5888	4068	msedge.exe	108
PID 4068 wrote to memory of 4660	4068	msedge.exe	109
PID 4068 wrote to memory of 3364	4068	msedge.exe	110
PID 4068 wrote to memory of 3364	4068	msedge.exe	110
PID 4068 wrote to memory of 4176	4068	msedge.exe	111
PID 4068 wrote to memory of 4176	4068	msedge.exe	111
PID 4068 wrote to memory of 5348	4068	msedge.exe	113
PID 4068 wrote to memory of 5348	4068	msedge.exe	113
PID 4068 wrote to memory of 5340	4068	msedge.exe	114
PID 4068 wrote to memory of 4456	4068	msedge.exe	115
PID 4068 wrote to memory of 4456	4068	msedge.exe	115
PID 4068 wrote to memory of 3244	4068	msedge.exe	116
PID 4068 wrote to memory of 3244	4068	msedge.exe	116
PID 4068 wrote to memory of 1716	4068	msedge.exe	117
PID 4068 wrote to memory of 1716	4068	msedge.exe	117
PID 4068 wrote to memory of 5208	4068	msedge.exe	118
PID 4068 wrote to memory of 5208	4068	msedge.exe	118
PID 4068 wrote to memory of 1640	4068	msedge.exe	126
PID 4068 wrote to memory of 1640	4068	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Oficio_247_CIF_SENASP_MJ.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x290,0x7ffd51f7c188,0x7ffd51f7c194,0x7ffd51f7c1a0
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,16556626429125977815,12517808367576433006,262144 --field-trial-handle=2376,i,4976491179591253,14664210990639457548,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,18005843484226998722,14240446315595282234,524288 --field-trial-handle=2376,i,4976491179591253,14664210990639457548,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:11
  2⤵
  - System Time Discovery
  PID:256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,735190602277398690,2431804510862156703,524288 --field-trial-handle=2376,i,4976491179591253,14664210990639457548,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:13
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3676,i,4389661394895393875,8784598458922909877,2097152 --field-trial-handle=2376,i,4976491179591253,14664210990639457548,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3680,i,2603299275495769219,1963557613877057817,2097152 --field-trial-handle=2376,i,4976491179591253,14664210990639457548,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4392,i,16318521861799662085,6125619413478628394,2097152 --field-trial-handle=2376,i,4976491179591253,14664210990639457548,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:9
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4376,i,7875174181663750476,949969287604360122,2097152 --field-trial-handle=2376,i,4976491179591253,14664210990639457548,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,1233089673896213903,1633720823305502367,524288 --field-trial-handle=2376,i,4976491179591253,14664210990639457548,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,10855372455099779818,9179897383008235914,524288 --field-trial-handle=2376,i,4976491179591253,14664210990639457548,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,529310084156167741,18226549735757885867,524288 --field-trial-handle=2376,i,4976491179591253,14664210990639457548,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,529310084156167741,18226549735757885867,524288 --field-trial-handle=2376,i,4976491179591253,14664210990639457548,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,13134675178701578157,10121194949430392329,524288 --field-trial-handle=2376,i,4976491179591253,14664210990639457548,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,6264747386612219794,16935334494196110095,524288 --field-trial-handle=2376,i,4976491179591253,14664210990639457548,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,10575616075191841229,17921198214577838686,524288 --field-trial-handle=2376,i,4976491179591253,14664210990639457548,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,16444660736345327880,15058291167545825992,524288 --field-trial-handle=2376,i,4976491179591253,14664210990639457548,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2064,i,4089709376357478489,9700546506325778382,524288 --field-trial-handle=2376,i,4976491179591253,14664210990639457548,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=812,i,8118169642463439164,7910833978725567379,524288 --field-trial-handle=2376,i,4976491179591253,14664210990639457548,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5452,i,14168722270391906260,4456533353001266066,262144 --field-trial-handle=2376,i,4976491179591253,14664210990639457548,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,770825241696942156,4498213441096595348,524288 --field-trial-handle=2376,i,4976491179591253,14664210990639457548,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,2705699062366833048,11678535518415472846,524288 --field-trial-handle=2376,i,4976491179591253,14664210990639457548,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:14
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,674917030105749067,3408932887742801015,524288 --field-trial-handle=2376,i,4976491179591253,14664210990639457548,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:14
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3452,i,4565404555733963073,9488305782807050101,524288 --field-trial-handle=2376,i,4976491179591253,14664210990639457548,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:14
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,19567309545979167,13592912080983598409,524288 --field-trial-handle=2376,i,4976491179591253,14664210990639457548,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:14
  2⤵
  PID:1640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4916

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

18d6aa32-bbc2-4bdc-b8fd-582582bb4781.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\18d6aa32-bbc2-4bdc-b8fd-582582bb4781.tmp
Size 33KB
SHA256 c7cf4767066f892f0b5fb19f48d766335ecaf4b72d6de024e32b386746b98ccd
MD5 61a06e7c7ab4195b75be730bbb875eb0
SHA1 11d92794d272d051edadcc2da1e004c94452be47
SHA512 42a9db292bf4655bd49a531656c9646898288d618738d7c54860290ed73e073fa0bf0288ff8d4a8be810ad064eea34657189db5ad8c98e4c0ddad03aa66d34f0
SSDEEP 384:+ZcIR38NQfEp6fomdeV+lqQN/nfydXiOcUCttNrgYg57HD8CJGZXhJqlX/XBdm/I:8R35QKqoKtEtNE57Y0GZxJsXBdK8Z6md
TLSH
T151F2CF30BC609A735DFBC3C5760A7583AEF492B3D6C94E58D9EE970D009B5AE030781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20846f64-fc07-491a-81ed-e3364034c9ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\20846f64-fc07-491a-81ed-e3364034c9ba.tmp
Size 34KB
SHA256 599d754e5537c71503e75e33e513df8cd1cdea85de7ade57753cfd25524c213b
MD5 7df2046d3767e890a8d5b7db8e0ef364
SHA1 ca0ad2ae3ab9bd7be822483294091ef35b8832ac
SHA512 409c46694bb0621c835ff2a299058923a489c36e870306b4f058f876b3cb3a790c9fab5d1f0fbe52f12f4d8d93dfd977a96cadffdb656a7b56bfc31a803ec8f1
SSDEEP 384:7ZcIR38NQf5p6fomde5+liQN/nfydXiOcUCttNrgYg57HD8CJGZXhJqlX/XBdm/I:jR357eioKtEtNE57Y0GZxJsXBdK8Z6md
TLSH
T167F2CF30BC609E335DFAC3D5760A7583AEF492B3D6C94E58D9EE970D009B5AE030781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0278db99-c497-4516-9392-a8855cee5cd7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\0278db99-c497-4516-9392-a8855cee5cd7.tmp
Size 105KB
SHA256 3f461bb307501118465fa355b5c41e2a705f236a6f0a9d6da2f7ec220831c703
MD5 b128b9eab72c965083b92d5147aa016b
SHA1 50e10f3f576f2ffa690298c3261891f992813335
SHA512 c7356be074c8c4dac39c2b53fc3c679e844ec686a16cf50df2caffd578fd4ff9775661084c859882e8c383687ff10fc72b9c4d7784ae1707436f3dee76196979
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7r:fwUQC5VwBIiElEd2K57P7r
TLSH
T193B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe09a9e94fbd795d6fab442dc426ef79e7bd47dbd80086b003cb1cd34d18db58
MD5 4da51a25f1a6b822ac642c6eae6f9a72
SHA1 9d4f1d1e83270c8d54d24725cd3d7f406de5967d
SHA512 c027a48a18b3b282e84d69320ca44ca416bceb43057eee8fcf4b2647669c307720f00240e17a22310df0488100938fd8b34a0660ca73adaa5f0433a1657b325a
TLSH
T16CD02BBCB76CC476E40210744042050052617004AC1704D10F0562448984080804114E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 54a604899198f01e1a2f5ec52bac53679a6d2775840ba8c81ab97c59f718adf8
MD5 b266cfe7dc8e59a4693bec2c7307d768
SHA1 0ff4c63ce201552fd340f72d3376df63989a21f9
SHA512 6832b9d56510cdd21708734b256b052e90f313f920ebc959b4845a1a4fc17cfbfe75dfa04c5252540531ead21e0662a341763e79030c36867f2823312c51c0f9
TLSH
T1C1D02BB8B77CC476E40210784043050052517004581704D10F05A2448984080804014E
MD5 SHA1 SHA512 TLSH

Submit Download

384efb8c-f35e-4c3f-833a-4a2eabf82e3f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\384efb8c-f35e-4c3f-833a-4a2eabf82e3f.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

44f06c34-8050-4392-9c39-b4712adecca1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\44f06c34-8050-4392-9c39-b4712adecca1.tmp
Size 23KB
SHA256 ae5c2a25deac463007c16f62953c0f418f9c46884cea13563226e493508bee85
MD5 0305cbf456a2804278dca0bff5fdb22a
SHA1 724ff7c1218a35c6afe4983f02b9c4d5fc5b9c1b
SHA512 3173aea551b6ac48e08c7570030d6ba4eff880ce3a445ab694729e36b9ce4b1e008c6bf69ed0839ecfcb2a124e23d4c4dd3349da52b6848db442b1f33929c4b3
SSDEEP 384:64qajXwfCtgmcFfsO7nKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV+a9mWRu9rou:6JajXKWgm0fsO7n8F1+UoAYDCx9Tuqhq
TLSH
T116B2C93F640DCB7F5FD00AAD9C19AE976D9802CB96588D4047FE984C02C77FA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ea5cdf6-beb5-4ac1-a959-91b6d381f76f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6ea5cdf6-beb5-4ac1-a959-91b6d381f76f.tmp
Size 11KB
SHA256 7c0768722143b91c6b003f9c765fc06658644ce9b6de19ddf7784bbb1be9e2f6
MD5 12c4008e7b353731cb4c8ea86ebe0f0b
SHA1 c7d38fabed9ea60ac3f34669cbfba88f6b96d2d1
SHA512 12f97804cbf41f85e2a8712f0868eed8b96b6dba26328ca564de7315f99417e467daee77cedad93108ed64f7d1e6cf5669b6c32a24b08c20460e7b7fbc86b613
SSDEEP 192:sxRtR+bm/fasa9cKfFzoA8p4y/g6+WNIYU2R3JYGBIgD9J:sxRtym/fasa9cKfo//5IMj
TLSH
T13C32A7156E68A93B8CCBD21EFB55BF53D2F95032A1911E48B6FC851C04EB6DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9415ad6c-86d9-44f8-8274-ccb1708deb70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9415ad6c-86d9-44f8-8274-ccb1708deb70.tmp
Size 11KB
SHA256 50391511a43e9007368ca7125268795fdd0ae93b0b024c313ba0ab3439708885
MD5 abc3f42dcf986297098428a5ed9801dd
SHA1 2700be68ed988cc0e4b44a6bf3a3c80c5d22b329
SHA512 0b7ceeb76860ab7e159b265fb6cfa9c5defdba5877d33b6401d83d5e23bf8ff29a8d7296b709f07bf71a35834adec2109841a0da4e8aa134d96bdb09e2ec7176
SSDEEP 192:sxRtR+bm/fasaCcKfFzoA8p4y/g6+WNIYU2RqJYGBIgDTJ:sxRtym/fasaCcKfo//5Ibh
TLSH
T18232A8156D68A93B8CCBD21EFB56BF53E2F95032A1911E48B6FC861C14F76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 13cd4fa57107b0b7b41046fe3b47b3ea7f4fd54883b7846014d3288207421a46
MD5 6289139eab79a29a85eb48ab9f4b8acd
SHA1 7d7fdd01ec2c07a5eb9a6e5a8f824c0082874797
SHA512 1b2631c076f1e98d54f64dcca858a3b401d4d8b8bb1cce18a361932ae26b48b649296343bbadb9814fde027a7e04d689ae4616df2fb555ecf9fcca79f65e5b00
TLSH
T1BFE020E919D7C65E77446447017C97CDC781379A92C0AD4D1B14C9487805058A3E5560
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 73a49e7c033b479533fb201054cbd28e892dd5a037fe40b184868a000202cdf7
MD5 7451ceed4f8c749644451e8a71042a4c
SHA1 7ed9072c45befe41d8b7fc3f30ae30793682a57e
SHA512 426f276ed31b2aae21005b7b1344678216c1cdd576af841f2a0dc11ae65819ff8eee5f5de619968059024b9f4abc92d6c6a854e002174995c864365a8878d010
TLSH
T189E078D849C5C21EB644E4870374D7CD939076DAE2C0AD0F7F00C54879C54447BD2D78
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 bf1ec4dd6c5981697c90fdfb99ab5ffb98f6fe866a0cff2bb246fbe3e9e08ec0
MD5 866d7b2bfa6fd2917788f15b0791583c
SHA1 596d138aa577b01065226f7ce581d7c9fcd03f21
SHA512 58615987350c0f85da7cf7f55aa1cd8b91629782dd71c44986a9bf4f9b390d1e2d3ebe564340608a822c2f02c6f8c3017a619202823153bbddc96ce6e01a80f0
TLSH
T130E020D808C5C21D794464470178DB1C8380379B92C0EA0D7727C6C87849088E3C15E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 71fe6c33d9880a19ac399a562ab498c8ff9d1604720efa5d5b6eead9711530eb
MD5 8214cca75ff5ec4a61807c2f17f339e8
SHA1 3bf2a42bd9cd79119e111f2bdd2b045b0a161689
SHA512 1a9734d4247c52e671fb7966c56e0f77c8f06173b93a4f299a870977949f561b5a0b2e6b2eb45205925f02f486791677cec63ab5c9fd455a5f55947b66e0f701
TLSH
T17FE020D84DCEC25D55C4644701B8DF4CC7D036DED3C0AF1D5B08D5987945448F3E1560
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 422953a3fe2da213d652900e76a77886dd2ffd31f8f85a41e15ad6d966fbfb4f
MD5 dc9da3b3696eea986937ba1aae4efa7b
SHA1 b40a843c60792c875456c53ecd1ad57b14a05d46
SHA512 19155a2398ce57230e00c6afd8d95c98dc625bdc52a71734b4632ddd3d4bb3108139f3b3c3d0fe1823f4db6850010d47c0a98734999cd43fc96df2b5c4ab14ec
TLSH
T1DCE07DEC19CBC22EB65874C741F8F70C8BC0379AD2C0A90E1710C7887E069C8B7E26A0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 805fcbb98b8fe2e240e6595d3e37d4775f49c86c98d3351608f913e702829a61
MD5 572f8a12fc39921329147e5a5f8081e5
SHA1 e90dddc08b799a0824c1b0f1707ae0b47cf13236
SHA512 761e86c0df280df3dc3b1b0e457c2ede93d661135cc447387c190f940e03b89056a2e682751b6228d536a9bb8faed5d5ab79acf63e9090bbe6a866a842a83e4e
TLSH
T1225197E865A085E2F7D48231B3C22CA7B53CC5B854432EB25757FEBF7906B19A36021D
MD5 SHA1 SHA512 TLSH

Submit Download

daa0e2bc-95d2-4fc8-b012-8572f0229fd5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\daa0e2bc-95d2-4fc8-b012-8572f0229fd5.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

26c593cb-a2e1-42a3-8770-56d2f52d8c2d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\26c593cb-a2e1-42a3-8770-56d2f52d8c2d.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

aa3594cd-e071-4f5b-9068-251c753fdcac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\aa3594cd-e071-4f5b-9068-251c753fdcac.tmp
Size 2KB
SHA256 4f277ab7b6fb52a67c5949f7c42909bd9d8bb073ecdf0ffdda0e23dea1aa8648
MD5 d51df09e28bf5b2a7ab1676d7428ba05
SHA1 8a2b6fbfd40780554b531ce523a161d5f3e77c96
SHA512 7b2f629449c4c6aab2dbff817ff27e047472d6e60f5889364330122d94fd8c37bbced6f800a3f83921a4bd0143c1a9ffc0ac4684cd37d0f5b4be32e349dfa4da
TLSH
T13C41BEF3C3E8866D8E0156F4AA146E1BCE2D0915432C3D5AC8D4AE2B93F34B1E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

c4f3e5d1-3459-4249-bd63-4ec6744535de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c4f3e5d1-3459-4249-bd63-4ec6744535de.tmp
Size 2KB
SHA256 80163296122d281077d49da081c916982c21acf494b05ba465203b3f25e60ab5
MD5 1a7483ab949f5c0551c266e66a387d66
SHA1 d4b715420c6d51a69d5780cfcea7c96fce722d32
SHA512 1a29e3a5ffd77a52dd172bbcf731cd591c84d5d9e4edfd563367144d850a56294d4a14250c3127115ddf6711be5fab547ed36ed77576294268aabb9ceb13090b
TLSH
T11E41BEF3C3E4866D8E0156F4AA146E1BCE2D0915432C7D5AC9D4AE2B93F34B1E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

f9ef5ac2-22f0-44a7-bc10-24953cba3cbc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f9ef5ac2-22f0-44a7-bc10-24953cba3cbc.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 51fc4438dfda7f58807c63f4e9e8ba8864934717a02014fe660543dd1122079b
MD5 31fae8875be24f47d102424c05c1a7ff
SHA1 15dccf43eae76d14ee110b81ac746e7c13204105
SHA512 0a1156d4475db93ec6c8513cffc19ac6c822b3c09343569be32acce6ce2633cf8de0b0cbfd5e0b9b2a7bbf571abb4a17b8355958ec7d4e86a13c83745c3432cd
SSDEEP 192:sxR2R+bm/fasp9cKfFzoA8p4y/g6+WNIYU2R3JYGBIgIJ:sxR2ym/fasp9cKfo//5IMs
TLSH
T11E32A7156E68A93B8CCBD21EFB55BF53D2F95032A1D11E48B6FC861C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc2e9447-353c-47c3-91dc-c2db3d743cba\index-dir\temp-index
Size 120B
SHA256 7f9a393c4efa4cf476493fffb2915981e89f4271cdb9a1136cea9bd3237cb135
MD5 bfb8fbb7aad112eb4c92a693c86e9c7d
SHA1 f80b47b95a7f86e57bc5ae53eeb71cdccad4aaaa
SHA512 4873c3082061747161cfa27d3ae23190aa27912aeebcbeafd9d278033c5f175820d33e33bc7a3132882cdd413c5ea68748458f67b84427b8d15a31a406d58ac8
TLSH
T1C2B012850C417640FD2255B1347E74601B570CEC1085767204FDD609BCB15E49081104
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc2e9447-353c-47c3-91dc-c2db3d743cba\index-dir\the-real-index
Size 120B
SHA256 8e2e693852bda0fa9254317400ad8f8671a582e9571d33f3f2dd9614221ed9b5
MD5 db76b124bc3391c16181aaed52dc24ed
SHA1 307516a0656b87314e157023c724eb7991f50ab8
SHA512 a3982d81394425147f992a92f04ddafed741d65a6073a99db29ad425465fee493bfb815a1a01f53857d90483124e1ceb964ecedd0fa125773071de704cad86d7
TLSH
T167B012400DD1A580FD1191F01CA7243119004CEC5451B23305B1D62A9CD12E05950200
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 370B
SHA256 d995f9a2570735656789e02ffc159b7b86b43f612259cae2ba874a03e696d90f
MD5 aa218a41e495cf405378023e3f464b61
SHA1 c53534fbb043cb13d8715ca4125393e4693377df
SHA512 a9915d1c08933d810437cc1b65f089157284e6e2c74e83eb2074e5caca21ab2bae5126e2261a4ff587901faec980a916609211f34c8959a5d144f5c4b923a8e1
TLSH
T124E068FB2ED71810E8DF83E414B204A40045B868C4406D4F642991D380E12552A56C36
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 51cfe0b20beae03e69ec984e59b4eba692f1daea4b78075b4e3f990f905abd40
MD5 77c991aa1e3ae7b58b1997390c68c8ec
SHA1 6cba6a123a88f23c5423a430fceffd04bcc314c8
SHA512 aa5bebcbe41a3172acec7d90f793e9dba3688296dcf5adcc51bb1e66b910cc7b253feb32944248729c29c75d2d72b9ebdbda3bc5314035484402c7f9dfbd2553
SSDEEP 24:KXpetUtI/KJhq1iSEfLyXYTMPUnIDKzhi1aS65fsPUw2IFK8hQ1+SZihyXhuxt:K0yI/KPqUHy5UIDKVicFxIFKKQYnyK
TLSH
T17391521131260640B97E7A0991E5AA9E828334E37019EE2F3FDA45A64F6FD048DFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ccbf6948-7766-4629-ad08-9206df24ab70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ccbf6948-7766-4629-ad08-9206df24ab70.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46391de3-5a4a-499c-b37c-ef3a964ca444.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\46391de3-5a4a-499c-b37c-ef3a964ca444.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

b00a20be-6a36-48e2-b043-3905a1b85ee4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b00a20be-6a36-48e2-b043-3905a1b85ee4.tmp
Size 37KB
SHA256 6b542bc368857aabefac39d209183b7c598f4d1c473e1f6c0ff7e134bb3878bc
MD5 60b224ba9baf4fba1535c17c8724a7c8
SHA1 fe97697400d71a5757ad374047ab25e9ee1231d5
SHA512 c91dc9a377a056916be058f2461dff5b29e030c3c04dc769a03993ade073377d052f9c1110bb49f42467ce784b3e6a98cbc1b105d523634e5f83e6de943c8204
SSDEEP 768:A/UxvxjgC+I3/QKttE57Y0GZxJsXBdK8lsSHUPpMs:tZj3+I3TU70/JsXf7iSfs
TLSH
T14603B034E8909D735DFBA394360E7287EEF446B3D5C55DA88AED9B0D028B26D034391B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba2d3982-0fe5-4934-a551-c78fb47216c6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ba2d3982-0fe5-4934-a551-c78fb47216c6.tmp
Size 36KB
SHA256 06083129acbb4526b8b5a9a713183b263918c57d1bdda40d674f051ca7b3d946
MD5 6144bd0ceace89cf5f1aeef9a47442be
SHA1 df3419a341b7aa9874e3dcc33d98bc18b0450e35
SHA512 1e89ef2f6b17e1b86f71e8841481ed3f90589814cac7f0620bb5218ee798cf08af7c7353d6544a841825db66cd1316e0324b8a7fde1a29450daf0d9e14d5cded
SSDEEP 768:uFQv35BwgheioKtEtXE57Y0GZxJsXBdK8Z6md:Fv35h/N70/JsXf7kmd
TLSH
T1B9F2BF31AC50DA77ADFACBD5B60A3143AEF442B3C6C98EA4E6DD9A0D00A71DD0347D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe5a7e72-c9f3-425d-bc93-02405d696f34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fe5a7e72-c9f3-425d-bc93-02405d696f34.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download