hxxps://contabilidad-deacero[.]com

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://contabilidad-deacero.com
Sample261027-2sclxaef54

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4152	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{F91B2E9F-7D02-4DF5-91E6-549C71AC4367}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1804	msedge.exe
1804	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 4024	1856	msedge.exe	87
PID 1856 wrote to memory of 4152	1856	msedge.exe	88
PID 1856 wrote to memory of 5024	1856	msedge.exe	89
PID 1856 wrote to memory of 5024	1856	msedge.exe	89
PID 1856 wrote to memory of 5024	1856	msedge.exe	89
PID 1856 wrote to memory of 1212	1856	msedge.exe	90
PID 1856 wrote to memory of 1212	1856	msedge.exe	90
PID 1856 wrote to memory of 4072	1856	msedge.exe	92
PID 1856 wrote to memory of 4072	1856	msedge.exe	92
PID 1856 wrote to memory of 4072	1856	msedge.exe	92
PID 1856 wrote to memory of 2280	1856	msedge.exe	93
PID 1856 wrote to memory of 2280	1856	msedge.exe	93
PID 1856 wrote to memory of 2280	1856	msedge.exe	93
PID 1856 wrote to memory of 4560	1856	msedge.exe	94
PID 1856 wrote to memory of 4560	1856	msedge.exe	94
PID 1856 wrote to memory of 4560	1856	msedge.exe	94
PID 1856 wrote to memory of 1032	1856	msedge.exe	95
PID 1856 wrote to memory of 1032	1856	msedge.exe	95
PID 1856 wrote to memory of 1032	1856	msedge.exe	95
PID 1856 wrote to memory of 3192	1856	msedge.exe	98
PID 1856 wrote to memory of 3192	1856	msedge.exe	98
PID 1856 wrote to memory of 4420	1856	msedge.exe	99
PID 1856 wrote to memory of 4420	1856	msedge.exe	99
PID 1856 wrote to memory of 2244	1856	msedge.exe	101
PID 1856 wrote to memory of 2724	1856	msedge.exe	102
PID 1856 wrote to memory of 2724	1856	msedge.exe	102
PID 1856 wrote to memory of 2724	1856	msedge.exe	102
PID 1856 wrote to memory of 3188	1856	msedge.exe	111
PID 1856 wrote to memory of 4672	1856	msedge.exe	112
PID 1856 wrote to memory of 4680	1856	msedge.exe	113
PID 1856 wrote to memory of 4168	1856	msedge.exe	115
PID 1856 wrote to memory of 4168	1856	msedge.exe	115
PID 1856 wrote to memory of 1804	1856	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://contabilidad-deacero.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffe9baac188,0x7ffe9baac194,0x7ffe9baac1a0
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,4567572524902611544,16360971037953747265,524288 --field-trial-handle=2212,i,4690704852481821568,12837687085717146245,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,11961783072328416963,11812129139532712163,262144 --field-trial-handle=2212,i,4690704852481821568,12837687085717146245,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,1028853298862084835,5424414954673017691,524288 --field-trial-handle=2212,i,4690704852481821568,12837687085717146245,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,4739938017534502372,15568443317172658018,2097152 --field-trial-handle=2212,i,4690704852481821568,12837687085717146245,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,8657477302032208275,14211925933661222464,2097152 --field-trial-handle=2212,i,4690704852481821568,12837687085717146245,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,10167038904231179312,8901456199033179446,2097152 --field-trial-handle=2212,i,4690704852481821568,12837687085717146245,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,17635247155983270471,14310934037196036602,2097152 --field-trial-handle=2212,i,4690704852481821568,12837687085717146245,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,10202198742030415814,2735038298485595361,524288 --field-trial-handle=2212,i,4690704852481821568,12837687085717146245,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,16416833498785059822,15892276500605556654,524288 --field-trial-handle=2212,i,4690704852481821568,12837687085717146245,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,6803038805841686422,2554666799148874735,524288 --field-trial-handle=2212,i,4690704852481821568,12837687085717146245,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,6803038805841686422,2554666799148874735,524288 --field-trial-handle=2212,i,4690704852481821568,12837687085717146245,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6076,i,4692600613263243106,16503241224459948700,2097152 --field-trial-handle=2212,i,4690704852481821568,12837687085717146245,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,16466164662549355603,17157807056167827547,524288 --field-trial-handle=2212,i,4690704852481821568,12837687085717146245,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,14243905526871967149,14223088413958715332,524288 --field-trial-handle=2212,i,4690704852481821568,12837687085717146245,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,1195320747325696617,13736772889796990569,524288 --field-trial-handle=2212,i,4690704852481821568,12837687085717146245,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,17703066951034466908,1345572659647929081,524288 --field-trial-handle=2212,i,4690704852481821568,12837687085717146245,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,1454816951165255801,11988921570380477053,262144 --field-trial-handle=2212,i,4690704852481821568,12837687085717146245,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1804

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

16a6c916-debb-4347-b5f3-e62cec951237.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\16a6c916-debb-4347-b5f3-e62cec951237.tmp
Size 8KB
SHA256 bf68845cae1edc7eb87c7589da44f2c5d14a6689c2d9b57528bef1cd2d927091
MD5 2c5f0b2ff584142903ee7bd22ef05641
SHA1 31ecfe55e2f7b73aaad81e6b7a7e0eb21d1b1d86
SHA512 ab4d61a85cd2480d6cd12e6544c00a9b0e9ee6c94cfa415949ddf2d1217f6b97fbee144992c0417cca02c025ee27299002105debdc3276160f8f5efa8a355c38
SSDEEP 192:1ON46wlDgQmiUyvZW4X58gZDOKaFbAIDlvQUU6:1ON46kgKW4X58EDOJbAs/U6
TLSH
T12D02D735B9787C7B8EF2AE49F58B27139FA5106BE6512F80C6E81A2D01D765C2307922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45df9786-9d50-4c3e-9a2a-39b8857cdde6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\45df9786-9d50-4c3e-9a2a-39b8857cdde6.tmp
Size 18KB
SHA256 b8c0e3d53508ff2b3f41e717a721f5b89544a15b7c8e6acba499856301ca4c40
MD5 b5b1e957138a8e779d07697bb5873554
SHA1 f71d8fa57b51f4ae2a3e0728159eaf39ef67da3f
SHA512 38b9faae766f7cacab9c9d7690233d841b7334d590f094a47bfe3e9e89dc0ba06999379c96edc581dc9928bde109c6b74e0779d68979c2180a641cbef8539c56
SSDEEP 384:gQkUSv0sNHY9bZks7HX58EDOJbAWWaGXvaTZcWbt/IIls:I0nTDa4Od+XvaTZck/L2
TLSH
T146827D31A86DAC374EF6E191F54E3603DFB09157E6842F90D6DDAB2D02E929C230BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b335173-cf6d-4fbe-81f1-492884660d9e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5b335173-cf6d-4fbe-81f1-492884660d9e.tmp
Size 26KB
SHA256 0d4e7a0b64995cda947b01e90138f0deded2fd4bae3a8079bf6f586babd5997a
MD5 b72367abcd15db797ba56495c725023e
SHA1 e7dc6760f01872971c64df6dda977e623f9378e9
SHA512 dd6245c16967d40c119d58c14ab790b5262aa1205ca9b724a71c1b7b637853635dc691516b41dc9131c6bf2e01b295deac408326eb0c3873a8c0e6c2e3381988
SSDEEP 384:viFzQkUSvqzsNZ8TUNTUlIlY9bZkl7HX58EDOJbAWWabXvaTZcWbt/IIls:6Fdiowg4aDa4OdTXvaTZck/L2
TLSH
T199C219F298DB9836DAAE9743A73D2D038EBCC157F5806A90F389551CCD961BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

2c0ade0c-dd92-42b7-881a-ed0dfe68a1b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2c0ade0c-dd92-42b7-881a-ed0dfe68a1b7.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

37fbb3f8-1ef0-4c51-a4da-65fb920e1c36.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\37fbb3f8-1ef0-4c51-a4da-65fb920e1c36.tmp
Size 10KB
SHA256 1e9e5d7319e83c71af89572a9226e547206ebbae29f6cd2aef216e229258bfbf
MD5 86f8ade4f712517fa84fe842b1240d26
SHA1 7268308aa7e2b9a7fa829226b15acb608c9f29d5
SHA512 db119d27eec6a4d1c542f86e9924e534a09c0506edda5205a2fe64e31f4ed199f0d7d10537c0cbd83fa214f1f4a982596f0789347f629d07723e0499850605b7
SSDEEP 192:sxZ7RMCWA/fFsJXIdpEsHW6+WNBpu/Yrgwe6Ig5OJ:sxZ7MA/fFsJ4hHbO/q4
TLSH
T1BC22C8526E38697B8CC7D24DBB29BF13E6F55032A1941E48A6FC8A1C05F7ADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5ef01f46-3414-47c7-ae7d-6a20280f04f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5ef01f46-3414-47c7-ae7d-6a20280f04f0.tmp
Size 9KB
SHA256 c93b5b71ad4122238a877b4187e263710fcc3d6d54ff90cde174c20ffaf7e179
MD5 2f408c30c1336e6f440ce16a99dd0605
SHA1 c997c411cf985850bb189b63b8c0a76e0a091f91
SHA512 1feba4bbcef30c27a16c03db58259c27971995868acee55ba795849658725b9202b1200e39c6d0d8616aaae0a7bbd8ba390c54f4582fa2c39db8100859880088
SSDEEP 192:sxZ7RMCWA/fFs+XIdpSsHW6+WNBpu/Yr0Ze6IgrJ:sxZ7MA/fFs+4XHbO/l9
TLSH
T13522A9526E38A97B8CC7D20DBB29BF53E6F95032A1D41E48A6FD851C05F6ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

614b2618-0db3-4b60-a99a-19e74ec6b2b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\614b2618-0db3-4b60-a99a-19e74ec6b2b2.tmp
Size 27KB
SHA256 9241988af6fb82e3498d7b1bffbdf40e8e4fbb67c6fe21302c58564e4671e983
MD5 30be60ce4ead4bf51a4eeb889d4539b5
SHA1 41f1045c06b92a5a20e0e45678ad46164a36398d
SHA512 53180240ad8b06a26d9881f30d94a3008e5426afae69d327309c9da11187cc40944a6e85320014c077a3672019bfc7565d98a18a9c2ed702563a866e56357f29
SSDEEP 768:Cvy4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbSroRcU:Cvy4J/DWvbtBhu1jajiLm0bJ+U
TLSH
T188C20B3B684CCA7E4FC00A9DDD5E6F973E9802C79A948D4047FA994C02C77EA91264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 59642857a6c5e70ca945beb411741e779c7d2e4901747c1738bc1ec9875bb1e1
MD5 4f1a42d0275da69687a1acdd1ae7290d
SHA1 28599a19b421e76e897022ee19e589c2c496b249
SHA512 358e5f3990536d24488c100868a90dedfd670fd927c87473679d8d68e3f6c6bf5a7621c935d8ff894674024d7384179ab91cdf248616b885672769fde245159d
TLSH
T1505160BA454A48D0FF1851F0DEE889873EB8A97D55C3CD0A37B0DCBAB9027797804C80
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 9aa8b85c3435a96e34ed58cd42ce4e9f4af06bc3fb73a2dd42a805c91e379807
MD5 44f69ad8336d32906ecdd7da212116a4
SHA1 5d15d29ce723590d17ce42e59e92532dd992c287
SHA512 011d75d16742ac573e983251a429b63ee8d241bdced676ad62a4be551d33065be1b380f51cd44dc2bbb7a21406180c1692f3727fa9a1b47012280d0979080c63
TLSH
T156514FBA454A48D0FF5850F0DEE985873DB8A97D55C3DE0A37B4DCB6A9427797804C80
MD5 SHA1 SHA512 TLSH

Submit Download

ec0023b8-96f7-4812-94f5-10d712252394.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ec0023b8-96f7-4812-94f5-10d712252394.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

64bb9e04-23c2-4e8e-8ac6-30a4a2fd2971.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\64bb9e04-23c2-4e8e-8ac6-30a4a2fd2971.tmp
Size 1KB
SHA256 84e81d869365b2fecef55616441b44b93c9b90c03aa790df4828231556ef99c8
MD5 7532ffca49dc6cdddfaff8b2a32bed70
SHA1 3785437404df97d9f4052eb12ba2309b29fb9eea
SHA512 2d8ff2b6a21f07a74a34837c53a335f995ff6d4506f8c8f81b714dec5416d099e2f268a23b6d9a051622c085ed1662ce968a22de67640ac0b241b0201d47ce6e
TLSH
T18231A3F38BB04A7D9B114AF099186F2BCE2E0056831C7D5A85D4AF37C3A3475D00195B
MD5 SHA1 SHA512 TLSH

Submit Download

71902f17-c1cd-4bc0-bb81-8409f0233f70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\71902f17-c1cd-4bc0-bb81-8409f0233f70.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

dd2f6694-2643-4871-b79e-ca4eb3ebb435.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dd2f6694-2643-4871-b79e-ca4eb3ebb435.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

a4308634-2dfc-4a7c-8fca-0b44fce4a0c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a4308634-2dfc-4a7c-8fca-0b44fce4a0c2.tmp
Size 10KB
SHA256 a79fbd91cd99bc3d3a649e65653912a2ff0bc863b82f30567f256964f5da2919
MD5 6415222f34f3ceb497d1dc988118ef6c
SHA1 d0515d4cf1dd3517f84d9fb27e6220ef93800b3f
SHA512 6568f1cb072bf0a106e50373a15f443c1e80dd67d62b01ffba0403262c97f91cd89343b2b7bf61b79d628d986ed266073146b1026dd0f2064642c3dafcdbb700
SSDEEP 192:sxZ7RMCWA/fFswXIdpSsHW6+WNBpu/Yr0Ze6Ig5cJ:sxZ7MA/fFsw4XHbO/lq
TLSH
T1AB22B9526E38A97B8CC7D24DBB29BF53E6F95032A1D41E48A6FC851C05F6ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b335368e-b539-47d0-89d3-440689bbb960.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b335368e-b539-47d0-89d3-440689bbb960.tmp
Size 10KB
SHA256 0af9cf25b9d0cc56db8f3d37314d008be2b2459ad752f671ef32f9b6cb113e92
MD5 dcff75215dff3e0981f18a443661a0df
SHA1 b6f3d36bbb89ce37e4439cc45d9ba9a1b31e7679
SHA512 b2068ba2c57f0835fb63bd7a27bf2168f2dfda48f7712a2d5bc90d66e54a5909a24e2de4ec4a420bfdada7a282f15c858f1b4184acd99ae7f89d3311765fadd2
SSDEEP 192:sxZ7RMCWA/fFsJXIdpSsHW6+WNBpu/YrlTe6Ig5OJ:sxZ7MA/fFsJ4XHbO/04
TLSH
T10022B8526E38697B8CC7D249BB29BF13E6F55032A1941E48A6FC8A1C15F7ADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1652883c-0eee-489d-90a1-d3a7065922df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1652883c-0eee-489d-90a1-d3a7065922df.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d094d2ee-0bd3-4c07-a6c8-6df525c39858.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d094d2ee-0bd3-4c07-a6c8-6df525c39858.tmp
Size 18KB
SHA256 a96f9c96468a058dcf5e7acca9fd44f13dcdaa3d5273c1cdd3930cc24b610376
MD5 600a3b73b9f138a1a1cbf598147a47c1
SHA1 d7657c9bf68b6f83c21a1e4c76ef80562f81f3d0
SHA512 5f70a07eee9c662ed1cf388f6c6f666abbdc959496848d1800653029bc6c825e51c18c765ef2d192dd275815856511ae8483b41245a6c058824a603a77bddff6
SSDEEP 384:AQkUSv0sNHF9bZks7HX58EDOJbAWWaGXvaTZcWbt/IIls:o0gTDa4Od+XvaTZck/L2
TLSH
T111826C31A869AC374EF6A191F54E3603DFB49157E6842F90D6DDAB2C02E929C230BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a4614f49-dcab-4078-8e81-384f7167ffb8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a4614f49-dcab-4078-8e81-384f7167ffb8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fb5da0ef-6159-422b-8585-e721e0a23b0e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fb5da0ef-6159-422b-8585-e721e0a23b0e.tmp
Size 8KB
SHA256 1a1c3e961089af3bde738c07179613bd64c65fef201395ed72738a166db58999
MD5 2205fa2e05f40e98a00dcfbf21de3a34
SHA1 8064f5ea76457616887e64f3765a67f6812326da
SHA512 b6ad5e6e4bce867dc9aa8b95dbb2fab7e57cacaa56e39fc0c6edd1ee9fe060d871a00857b78f69135cd927c16e4414a9fd56bbf3a9db0864634050cc727ac3d4
SSDEEP 192:LONi6wlDaQmiUy2ZZ4X58gZDOKaFbAWWaDvecqlU6:LONi6kWNZ4X58EDOJbAWWaCXU6
TLSH
T198121931B878AC375EE2A589F48736039FA55157E7857F90C6DC2A1C01EF6AC230BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 725f1dfdb3da08ce7cc96b9c907087ab9aab1ce15cee348a75468c2beb18aac4
MD5 ecdc6516895453d2288a8d7a2611ef0e
SHA1 88a859efb14a0485c9d553e8baf014f2f048fb76
SHA512 cb06b5dd172b5f38c2bd5e29b34ac9126a1e51f1a593faf28ee8c802932ff972d82b408282a97e16b1768a2b6d8167e0afd4061821bd3bf298d68f6e17d5359b
TLSH
T180412648BAE91148B3B73F56ABF6A86D887FB9772F06D45D00120D8E0A26B00C931737
MD5 SHA1 SHA512 TLSH

Submit Download