hxxps://sso[.]correodinamico[.]cl/

Analysis

user interaction
yes
max time kernel
1049s
max time network
733s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/10/2026, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://sso.correodinamico.cl/
Sample261022-2grlpays8m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2872	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{36E60671-18B8-462C-AB02-41E07A88509C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2188	msedge.exe
2188	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 5896	4172	msedge.exe	84
PID 4172 wrote to memory of 2872	4172	msedge.exe	85
PID 4172 wrote to memory of 5948	4172	msedge.exe	86
PID 4172 wrote to memory of 5948	4172	msedge.exe	86
PID 4172 wrote to memory of 5948	4172	msedge.exe	86
PID 4172 wrote to memory of 3124	4172	msedge.exe	87
PID 4172 wrote to memory of 3124	4172	msedge.exe	87
PID 4172 wrote to memory of 5264	4172	msedge.exe	89
PID 4172 wrote to memory of 1264	4172	msedge.exe	90
PID 4172 wrote to memory of 5264	4172	msedge.exe	89
PID 4172 wrote to memory of 5264	4172	msedge.exe	89
PID 4172 wrote to memory of 1264	4172	msedge.exe	90
PID 4172 wrote to memory of 1264	4172	msedge.exe	90
PID 4172 wrote to memory of 1456	4172	msedge.exe	98
PID 4172 wrote to memory of 1456	4172	msedge.exe	98
PID 4172 wrote to memory of 5128	4172	msedge.exe	99
PID 4172 wrote to memory of 5128	4172	msedge.exe	99
PID 4172 wrote to memory of 996	4172	msedge.exe	101
PID 4172 wrote to memory of 4900	4172	msedge.exe	110
PID 4172 wrote to memory of 4900	4172	msedge.exe	110
PID 4172 wrote to memory of 4900	4172	msedge.exe	110
PID 4172 wrote to memory of 4184	4172	msedge.exe	111
PID 4172 wrote to memory of 4184	4172	msedge.exe	111
PID 4172 wrote to memory of 4184	4172	msedge.exe	111
PID 4172 wrote to memory of 1404	4172	msedge.exe	114
PID 4172 wrote to memory of 1404	4172	msedge.exe	114
PID 4172 wrote to memory of 1404	4172	msedge.exe	114
PID 4172 wrote to memory of 3852	4172	msedge.exe	115
PID 4172 wrote to memory of 3480	4172	msedge.exe	116
PID 4172 wrote to memory of 4376	4172	msedge.exe	117
PID 4172 wrote to memory of 1724	4172	msedge.exe	119
PID 4172 wrote to memory of 1724	4172	msedge.exe	119
PID 4172 wrote to memory of 1724	4172	msedge.exe	119
PID 4172 wrote to memory of 5620	4172	msedge.exe	120
PID 4172 wrote to memory of 5620	4172	msedge.exe	120
PID 4172 wrote to memory of 4324	4172	msedge.exe	121
PID 4172 wrote to memory of 4324	4172	msedge.exe	121
PID 4172 wrote to memory of 4232	4172	msedge.exe	122
PID 4172 wrote to memory of 4232	4172	msedge.exe	122
PID 4172 wrote to memory of 4232	4172	msedge.exe	122
PID 4172 wrote to memory of 2188	4172	msedge.exe	123
PID 4172 wrote to memory of 2076	4172	msedge.exe	124
PID 4172 wrote to memory of 2076	4172	msedge.exe	124
PID 4172 wrote to memory of 2076	4172	msedge.exe	124
PID 4172 wrote to memory of 4708	4172	msedge.exe	125
PID 4172 wrote to memory of 4708	4172	msedge.exe	125
PID 4172 wrote to memory of 5716	4172	msedge.exe	128
PID 4172 wrote to memory of 5716	4172	msedge.exe	128
PID 4172 wrote to memory of 2376	4172	msedge.exe	138
PID 4172 wrote to memory of 2376	4172	msedge.exe	138
PID 4172 wrote to memory of 2376	4172	msedge.exe	138
PID 4172 wrote to memory of 2440	4172	msedge.exe	139
PID 4172 wrote to memory of 2440	4172	msedge.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sso.correodinamico.cl/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc1625c188,0x7ffc1625c194,0x7ffc1625c1a0
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,6227609859022548097,12970632626650765186,524288 --field-trial-handle=2336,i,9812903026205019984,10566603521976511218,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,1298171796761475007,16099274024930788040,262144 --field-trial-handle=2336,i,9812903026205019984,10566603521976511218,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,10566343948625250317,15426355306561092392,524288 --field-trial-handle=2336,i,9812903026205019984,10566603521976511218,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,13429321457145273705,12809619334217556543,2097152 --field-trial-handle=2336,i,9812903026205019984,10566603521976511218,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,6378273536836390986,9469070635628205862,2097152 --field-trial-handle=2336,i,9812903026205019984,10566603521976511218,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,12073896549954235134,5496530904562273515,524288 --field-trial-handle=2336,i,9812903026205019984,10566603521976511218,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,10168878154802648761,11411198550552657125,524288 --field-trial-handle=2336,i,9812903026205019984,10566603521976511218,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,320211513793530429,10518572766559951879,524288 --field-trial-handle=2336,i,9812903026205019984,10566603521976511218,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,320211513793530429,10518572766559951879,524288 --field-trial-handle=2336,i,9812903026205019984,10566603521976511218,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6128,i,16333531989965124951,10210386014729928474,2097152 --field-trial-handle=2336,i,9812903026205019984,10566603521976511218,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4840,i,17871346806677668639,5368555687317379739,2097152 --field-trial-handle=2336,i,9812903026205019984,10566603521976511218,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6112,i,3299683694056684600,9868495576521847404,2097152 --field-trial-handle=2336,i,9812903026205019984,10566603521976511218,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,16085746148740217074,6551700730630472076,524288 --field-trial-handle=2336,i,9812903026205019984,10566603521976511218,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,13600314286731421198,8452272733487077238,524288 --field-trial-handle=2336,i,9812903026205019984,10566603521976511218,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,18372225074156733379,8346999831409921106,524288 --field-trial-handle=2336,i,9812903026205019984,10566603521976511218,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3444,i,6139928653479031887,11376069983640758063,2097152 --field-trial-handle=2336,i,9812903026205019984,10566603521976511218,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,5722884170234363506,11099372174508315263,524288 --field-trial-handle=2336,i,9812903026205019984,10566603521976511218,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,12527195564375300635,16918695476247894201,524288 --field-trial-handle=2336,i,9812903026205019984,10566603521976511218,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5204,i,5760242145175009229,6641048335063225775,2097152 --field-trial-handle=2336,i,9812903026205019984,10566603521976511218,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5520,i,14628384231314604465,12599724463837763045,262144 --field-trial-handle=2336,i,9812903026205019984,10566603521976511218,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5332,i,15947391147337667998,5451413021617299749,2097152 --field-trial-handle=2336,i,9812903026205019984,10566603521976511218,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,12049190313253160777,4039990428194755418,524288 --field-trial-handle=2336,i,9812903026205019984,10566603521976511218,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,8496591040023134799,14177744427924683637,524288 --field-trial-handle=2336,i,9812903026205019984,10566603521976511218,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5264,i,16638097857874269125,2070888456537383619,2097152 --field-trial-handle=2336,i,9812903026205019984,10566603521976511218,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,1837420131644544660,11840446397478866000,524288 --field-trial-handle=2336,i,9812903026205019984,10566603521976511218,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:2440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2e6cbd4a-5fff-4244-ba6e-10306f092906.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2e6cbd4a-5fff-4244-ba6e-10306f092906.tmp
Size 25KB
SHA256 f4a9ce5fa8e3f3c0f109dc7ffa3c877601beb69ba7c94008fe2ee77cc15659eb
MD5 360f84def2a3edde45cf371e12d99473
SHA1 c8eed4e6c53dbc4fdd9ac57e86034e5f96dbeabb
SHA512 ce8cde2b91e8eb6488d59f0435b60026730b823bf205614d3c7a6c62e5b8f2a7236310d3aa437395fb1b3681601f3095f8001070d669b8a0b8bce3d6f87a9b9e
SSDEEP 384:nHiFiZcI63sNw8TUNTUlIm2aKMik4w2fLBCPhufsCF1sa+VYJfgL/7IzNo5:CFQ635wgc9oBCPhSsCF1hguq
TLSH
T15BC24A36EC88DAABE8EB4FD5AB4A7A13DEE40163C59C56D4CAD81D1D009729D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50b79c11-a32c-4a5c-9eeb-ea5dc4f68d10.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\50b79c11-a32c-4a5c-9eeb-ea5dc4f68d10.tmp
Size 27KB
SHA256 51972f07d7bd6918118dc640f30a5a06c42fa1a8abd1b91fd403daf00a0366a2
MD5 4e62548376195977513fd8ee28a82dce
SHA1 7ce4cb91a0c338ed9787796866f989f682c3c13d
SHA512 2443b0a7b1e7d015b7bd569a8df7b25bed8b2e3e4c2ef5e9e68ccd9071854b441291136fe020c2f8438bd14469993c43c22620f0ba293265672a4fd522ed95e1
SSDEEP 384:nYiFzQkUSv0V3sNH8TUNTUlI4kaKMCZPow2fLBCPhufsmubmMvwQTTgL/7IztIIQ:jFdw3CwgiSYBCPhSsmKmMvBLQ
TLSH
T1DBC23A32E898DABBEDE74E95B74A3607EEE04213C98C5AD4DADD1D1C00CB1DD530B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f8cad5b-8e0f-4577-ae91-80b1470fa73e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5f8cad5b-8e0f-4577-ae91-80b1470fa73e.tmp
Size 25KB
SHA256 ca646a5881c201bea0192bf4bca59ddd681fb24f478262c3b60c96c28acb3ece
MD5 81ac22a63d71aa324e490acb5ad5ae2f
SHA1 197d05a24e638a95e31874eefddd068b46eeacf2
SHA512 f2d1f8724bdf007865282d9a740674939dc763d1e7e8059a2d7fabd84d9d556e6cfd3da69575ac6f52eb120a0aae61a10a33885f72c3d83eb24e240177e5c555
SSDEEP 384:naiFiZcIv3sNH8TUNTUlI4kaKMCbPow2fLBCPhufsmuqiMAgL/7IzIoX:RFQv3CwgiWYBCPhSsmxiMxQ
TLSH
T12FC23A32EC98D9BBECEB4A95A74A3A13DEE00163C58CAAC4D9DD5D1D00D71ED430BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

740b7712-534b-4107-8f37-a7de4114569c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\740b7712-534b-4107-8f37-a7de4114569c.tmp
Size 26KB
SHA256 0e13fbe31240c933f218344e602fef7ed7d7e69fdc0b796ab8b0c38bd5829537
MD5 3de83093a9837673d123fbbfb6e5cbc4
SHA1 557954e530212efcd24f6f3b4ad3c2e6397fd0f8
SHA512 f0fb7da587084ca88e5ee86488428d21c79cb1c8d26df227e8d8daccbf82d12c715ee3ef93718caddd43381ced10d11c5470cd09a59c88a0f223af60df0ba1bf
SSDEEP 384:naiFzQkUSvc3sNH8TUNTUlI4kaKMCZPow2fLBCPhufsmuViMvwQTTgL/7IztIIl6:RFdc3CwgiSYBCPhSsmoiMvBLQ
TLSH
T1AAC23A32E898DABBEDE74E95B34A3607EEE04253C98C6AD4DADD1D1C00D71DD530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

740de357-6549-47f8-ad39-fbdfa039e084.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\740de357-6549-47f8-ad39-fbdfa039e084.tmp
Size 26KB
SHA256 b9277a4db5745043fdacd89ea86553f5fac63889bfdc519a19397cf74757b2c8
MD5 0b02b6b3708331e58e5eaa6a0f7b3597
SHA1 f351dcb33352e9deab25be7b4914079a61066e68
SHA512 e92d238d785d11b05851f393dc10b290b7a2cd6aba3a0cbbcfb9be8be4a05b5829a177883df1589db4e507dff50bcecf72f7d8ede12ef9ceebf67060ea31aa4e
SSDEEP 384:n0iFzQkUSvc3sNH8TUNTUlI4kaKMCZPow2fLBCPhufsmuViMvwQTTgL/7IztIIl6:PFdc3CwgiSYBCPhSsmoiMvBLQ
TLSH
T13CC23A32E898DABBEDE74E95B34A3607EEE04253C98C6AD4DADD1D1C00D71DC530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

030800a0-5dfc-40f3-92d6-234b7083b759.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\030800a0-5dfc-40f3-92d6-234b7083b759.tmp
Size 414B
SHA256 70da3fae9e6e405a89ef5fe0d7c2acc16171acce41f5a62dafddf788493ec367
MD5 6cd08daf475c3736b82826cf3722c3f6
SHA1 65598b8159387ca7b19bc478d6f8099c636a27b4
SHA512 7b344d3e5a892d2f6c4a05d77ee679fb287da90bb370ced59fe76aa861eca8748fca6a6b117080e5e016bd5f205935a3300cf27005fb8781021c8373c9c8e4af
TLSH
T1B8E02BAAC811FC3B0CFD4B7864540249E75413672B41D84B3B3D8018CFB05374285C6C
MD5 SHA1 SHA512 TLSH

Submit Download

0933fb01-adaf-4821-abe5-9448246d8444.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0933fb01-adaf-4821-abe5-9448246d8444.tmp
Size 11KB
SHA256 daa90e6bef6768b46266cd3c5d26de5903434b18809090c60017bef095876642
MD5 048a93ffac7a184b536cd3590a42f469
SHA1 30108e3675e6bdcaf7602bb8aa11493b2ef4f5eb
SHA512 6d6046ed8d3789de7a4342d731d54f3898586909b0a9bf4a6324b40f1098e3a7da09b9f888d584f98c2c0594361d55932be9f67a3397a60d61e9bc16735fa2ab
SSDEEP 192:sxZuTR4ky/fysFaQZLu8EzodpLHW6+WNGYoFpXSsgIgjtvJ:sxZuTRy/fys4OR3LHbGRS1jtx
TLSH
T1D542E815AE28A97B8CC7D219FB557F53E3F9103390911E48AAFC8A2C15E7ADD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

282085a7-9059-4ace-92a9-8de90d248cd5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\282085a7-9059-4ace-92a9-8de90d248cd5.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 47f0ce2f71252763f627c9b6c2d6dd9356415b84732357839f10fa6cd136cdef
MD5 736fb4dc351cb20b5f43e0eb97727fcb
SHA1 a4dde9479241ad8ce35385f5e2aeb14f1457b511
SHA512 fd5bcccd3128b227e3ec9506021b6a0488adc6230e980eafcfd98fc5a56af05af859de00e6a0e74d9c4951ddcb1b12e57921565c3a98c4f53f1b061c8b5e526d
TLSH
T1A5E0268414ECC33EF22A688F0278E34C8790662BF7C4B93E1704C9C572C7894AAC36A1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 cce6f3020c6468aff9a76361e013f1f7d4f9cc5ff85b754526d746437489bb8c
MD5 96d46fd65bda2cf63c428b8fc1901f6e
SHA1 1f5c23dfe21dcbba4c07e07d192b7711dabbf284
SHA512 12aff32c55f027be95f987ded97eca73331881c899a2ce59dbd657a89a159e479d96f2cea565fb2a58fd8cb53c422d48e506c4fb3566fb5f6046ba205589b288
TLSH
T1DDE0268834E8C33EF2287C4B016C830CD3E0E6ABA2C0A92F5700C9C67686840A3866E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 da4970375621da497d1eb4e6039c2253d30e8d59ceede14345401149481ccee0
MD5 72c9a4e574ca93ca77b5f8b67d3164d5
SHA1 7c174cb99b4152121b5672eb5e5a1531d474c05d
SHA512 f59d6d9f081078a7846f8f18e5c82cd751dfc54b6db96666a89961c019b7ae7a4aaf378d21d79eed1d03014ae851bfc125a0fec8b5e0508da9c8b40195af13b4
TLSH
T1CAE0208406D8C73DF106684F01D9E70C83903A6BA6C0A96D1700CDC4F286C5CF79B560
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 d46a405977cb964fe1a72a11b991abac9997c562012b88eb1e6d1fa958f2fd6c
MD5 1c3dafeaf93319aa3ebe386953529a58
SHA1 30e17d511010622f05d2fe6d3199a77db06022b6
SHA512 e12346c57bc1d87e305210a90276a54f045f950c4df5721ec6d97b01845d93d5516b5e88186e1cc64a6666c58d3e9a5aeda27b0276a030b080e65fd6789b81c1
TLSH
T1CFE0208804D4C33DF397684F81989B0C93D0766BA6C0E96D9B00C9C879C6050E281565
MD5 SHA1 SHA512 TLSH

Submit Download

ebc59f5c-efef-478e-bb76-070173a7aabd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ebc59f5c-efef-478e-bb76-070173a7aabd.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

40c1cfd1-7d37-48b4-a0b5-505f0775df60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\40c1cfd1-7d37-48b4-a0b5-505f0775df60.tmp
Size 1KB
SHA256 132412071a5491d04101fc77cb6493f885ce46c09791f9bf223413ebd68ebe77
MD5 3a54f66fcd4edf215afd67a7fb00ee99
SHA1 0c9021b0178a745d5a0f39871278eac9636ac466
SHA512 ba8d399602c24524c2553469a57341b8c080f2e8bc0c966cbbf03b8d94802d70494d440c686ae7d5337df0e176bef338853d9c09a1f98f9269e628d39ad03761
TLSH
T18931AFF387E5865E890196F0AA18AE2FDF1D0514432C7D5A84E4AF1B83F3471D14165E
MD5 SHA1 SHA512 TLSH

Submit Download

b326a754-dcb4-4ad1-8d54-2c70d9c688bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b326a754-dcb4-4ad1-8d54-2c70d9c688bc.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

c4bdd7b5-db59-48ea-96a1-a26cf0fa045e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c4bdd7b5-db59-48ea-96a1-a26cf0fa045e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

da487f51-1843-4ed9-a41b-9a0633581834.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\da487f51-1843-4ed9-a41b-9a0633581834.tmp
Size 1KB
SHA256 f9c261d5a9814de30aeab4771e3f53cdbc2e7097c4cd81caacb888465c59e8d8
MD5 00f2ba327efe9cc200d76a94605d4f82
SHA1 048414ff7c79f9dcef7fd966dbfaebe071c920cf
SHA512 6c85b73b6175326875c0b3ddbf8befa4b45a311762e1758f90d6a512bfe3f7c3c58fca8655f76a9a68135987d62b94167d12069c15b551cec51566c4395fea7a
TLSH
T12A318DF387F4856E8A0196F0AA18AE2FDF2D0515432C7D9A84E4AF2783F3471D04169B
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\78cd9fa7-1df6-4d84-9aea-c387bdb37015\index-dir\temp-index
Size 2KB
SHA256 64231a5e4aeb88c12b151cb38dbea96906ab06e7f6449d6e0dc3ff74c4dffb5b
MD5 bbb45177aa017e6b809c7af2f15c5e07
SHA1 7ed6779fb3ab875d9d388d74ac5237779e07db12
SHA512 3a85fafd58f89d84011d9c1fb0a705d6bb22981c02c6ceb99b27dc5b558540b9213444096506d8ee27e18b3eb4a13794e20ee5b6fe3a19bf9ce5fe10b97ea916
TLSH
T13851C64E4D031767ECE8137214BA14D533B8A0CC13589D1BA1FD9135E8C3B14AD5976C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\78cd9fa7-1df6-4d84-9aea-c387bdb37015\index-dir\the-real-index
Size 2KB
SHA256 2a831fada71663348f52f66a68f304924a49abca159e477a6409c97bfd1e0e04
MD5 35f40cc992f75701c6d2695155758d7f
SHA1 17269dbfd68ba1ab756c98a238a9b2cb34d7a059
SHA512 f072a14cbd3642a4502fa9ecc52b9df5903e2096d7f20250bb0a40c032737df0bb376424349e68537c164b80673faa5180df65fb5b993c2c4aea2c040c8a6b7c
TLSH
T1AB51935A4C024735EC8402B309E95896333AA14447883F0F71EDD232ECC235CBD4ABE4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 959df82261b18815364ba4ca625fd651739ed3e0b48104d69e316ab81336e87f
MD5 b011edcb4efcba68060db1e70f0a59fd
SHA1 4b7834927138e17c171305f3153e9cd0851cbd75
SHA512 a42f3cc83f31231ad17ec674c6e9f30653141c680ed9de1741efb4497baadc1d127739e874ed489faf80f289231b3baba36e264c06f66e7a5df760002f75a563
TLSH
T1A2E0C6F72EA31821ECBB83C6243204908800B8A88551BDAF246BA3C740F23023817C62
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 0a3f7b13520c6babfef7359ee88546822c1d661de246e60264bad17471a0cee4
MD5 c453a55c0972890326c172bdb617babb
SHA1 398f1d96efa829f6c9346a08504afd856fc14594
SHA512 bd5de2320b6f837dbe34ae69521ee88f301750a3fe4c7f57190a51341da598a38b2576f3aac420668c0b6a7315c070c833d90e8be67a9c54812a2bce0bc39907
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgp:ST/2dXOJhJlpfnpp3tNXVrN3gzBa
TLSH
T14DB2315571BB421039FE295C82B6972E168231733119E66B7FBD00B68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

cbdca942-8b5b-412a-b5b2-032575ebe3f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cbdca942-8b5b-412a-b5b2-032575ebe3f3.tmp
Size 12KB
SHA256 2fda275851d050c31f2dbd23477574d523907d12e59e48570971000e6f5025aa
MD5 5b12d3da48bc406f7428b2cfef39c451
SHA1 f17a49ac71c80ce037b5f15f7a8cb7e7dab49484
SHA512 136c1ad2efbbd827e1ea00feaaad426be38db93770c0f969c54df1926d924e904efcca7255c630a3baafa1620d38fd5f0358323be17616aa79e24ad601e40e09
SSDEEP 192:sxZuTR4ky/fysMQZLX8EzodpwrHW6+WNEx2/YoYpXSsgIg5itvJ:sxZuTRy/fysMOo3GHb3/yS1Etx
TLSH
T18642F916AD28A97B8CC7D219FB59BF53E3F9503290C11E44AAFD8A1C15E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e764e39d-df3e-43e4-abbd-eb48678288cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e764e39d-df3e-43e4-abbd-eb48678288cb.tmp
Size 11KB
SHA256 8fa6370d4b5ade11a427c4222d8e05bbd38f32f28616cc156f52446bac451241
MD5 d6a2e1c38efa5566e66ab17b9e1d36b9
SHA1 9c2da8177167bffbf96d415a6d5da379f27205a7
SHA512 3a2b11d48428140138beb6506578d8192f810dfabcb2a5bbe7c4bff62f90c27f0c136766893cba86f91a856bd105e2724d874faa9c1d76702fc3594ac70d468a
SSDEEP 192:sxZuTR4ky/fysRaQZLX8Ezodpw8HW6+WNGYorpXSsgIg5itvJ:sxZuTRy/fysEOo3ZHbGzS1Etx
TLSH
T1FB42E816AE28A97B8CC7D219FB557F53E3F9103290D11E44AAFC8A1C15E7ADD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1a5a4ad-e035-4638-997c-d8057a545276.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a1a5a4ad-e035-4638-997c-d8057a545276.tmp
Size 26KB
SHA256 e5c061db1652b50e261754a1afb63c4eb4dc7c4373d25d28a936c9d2f71a675f
MD5 ad8dc09ef4af35c5a176b2a2b3dfd093
SHA1 af00f77d5c9c3985be0eaad7da1eb3ce02b5d07b
SHA512 6c6957effe71834641093c7ff936a2ffe613c0fad2be8f49ed986f74225c22d7492a324e677558ad6bdec537c17e348889ae0e36be28afbc696155b3e1449d35
SSDEEP 384:n3iFiZcI63sN78TUNTUlIm2aKMB7lw2fLBCPhufsmuriMsa+VYJfgL/7IzNo5:yFQ63SwgcrTBCPhSsmeiMhguq
TLSH
T1ACC23932EC88D9ABECEB4BD5A74A3613DEF44263C58CA6D4C6D81D1D00DB19D430BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2ec9543270759825f1a885aabb3a22a680e563034384ec750b202d340b388664
MD5 ad49a5a814d1db577e9d497bcee3bf88
SHA1 dbaf6c4a79e510b9becb2f3ce05f957bd0f68327
SHA512 a6a4c32575a50c1b9e5a7627ef049e443d97d24cc688885ad2aa34473a20e172365bf1a18f7287c18dd6b1738588685325c4842863c1bb2490a237f7634eb82c
TLSH
T14E41F959B6FA1144B3B76F16ABF768AE887E78732E17945E10110E4F0A62B40CC71737
MD5 SHA1 SHA512 TLSH

Submit Download