hxxp://medsoftapi[.]medgrupo[.]com[.]br

Analysis

max time kernel
148s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://medsoftapi.medgrupo.com.br
Sample260804-rwkrkscc89

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3764	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303275671707112"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{143CC2B0-A9E8-4215-AD60-CD5A4B068DFF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 4916	1488	msedge.exe	85
PID 1488 wrote to memory of 4624	1488	msedge.exe	86
PID 1488 wrote to memory of 3764	1488	msedge.exe	87
PID 1488 wrote to memory of 4624	1488	msedge.exe	86
PID 1488 wrote to memory of 4624	1488	msedge.exe	86
PID 1488 wrote to memory of 3192	1488	msedge.exe	88
PID 1488 wrote to memory of 3192	1488	msedge.exe	88
PID 1488 wrote to memory of 1532	1488	msedge.exe	90
PID 1488 wrote to memory of 1084	1488	msedge.exe	91
PID 1488 wrote to memory of 1532	1488	msedge.exe	90
PID 1488 wrote to memory of 1532	1488	msedge.exe	90
PID 1488 wrote to memory of 1084	1488	msedge.exe	91
PID 1488 wrote to memory of 1084	1488	msedge.exe	91
PID 1488 wrote to memory of 2728	1488	msedge.exe	92
PID 1488 wrote to memory of 1068	1488	msedge.exe	93
PID 1488 wrote to memory of 2728	1488	msedge.exe	92
PID 1488 wrote to memory of 2728	1488	msedge.exe	92
PID 1488 wrote to memory of 1068	1488	msedge.exe	93
PID 1488 wrote to memory of 1068	1488	msedge.exe	93
PID 1488 wrote to memory of 4396	1488	msedge.exe	97
PID 1488 wrote to memory of 4396	1488	msedge.exe	97
PID 1488 wrote to memory of 4396	1488	msedge.exe	97
PID 1488 wrote to memory of 1900	1488	msedge.exe	98
PID 1488 wrote to memory of 1900	1488	msedge.exe	98
PID 1488 wrote to memory of 1900	1488	msedge.exe	98
PID 1488 wrote to memory of 4944	1488	msedge.exe	99
PID 1488 wrote to memory of 4748	1488	msedge.exe	100
PID 1488 wrote to memory of 4944	1488	msedge.exe	99
PID 1488 wrote to memory of 4748	1488	msedge.exe	100
PID 1488 wrote to memory of 4032	1488	msedge.exe	102
PID 1488 wrote to memory of 4416	1488	msedge.exe	105
PID 1488 wrote to memory of 5056	1488	msedge.exe	106
PID 1488 wrote to memory of 4372	1488	msedge.exe	107
PID 1488 wrote to memory of 1600	1488	msedge.exe	111
PID 1488 wrote to memory of 1600	1488	msedge.exe	111
PID 1488 wrote to memory of 4856	1488	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://medsoftapi.medgrupo.com.br
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffab253c188,0x7ffab253c194,0x7ffab253c1a0
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,8390206322248210830,13232334482650665285,262144 --field-trial-handle=2308,i,15335646008277465535,2626139671123493397,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,18021906382481871028,11929774445924654486,524288 --field-trial-handle=2308,i,15335646008277465535,2626139671123493397,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,9716906436376810873,13045827480669745921,524288 --field-trial-handle=2308,i,15335646008277465535,2626139671123493397,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,11763391905585348229,10275277264753846410,2097152 --field-trial-handle=2308,i,15335646008277465535,2626139671123493397,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,9100448791019523472,6651364315131901382,2097152 --field-trial-handle=2308,i,15335646008277465535,2626139671123493397,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,10744780849130247705,13473464384574099903,2097152 --field-trial-handle=2308,i,15335646008277465535,2626139671123493397,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,15799746517075152687,2824575946778983398,2097152 --field-trial-handle=2308,i,15335646008277465535,2626139671123493397,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:2
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4268,i,3899793104784189355,16285780518517147342,2097152 --field-trial-handle=2308,i,15335646008277465535,2626139671123493397,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5132,i,3833373106801891179,18370545210034779938,2097152 --field-trial-handle=2308,i,15335646008277465535,2626139671123493397,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,11251114646526725035,10382316900971949788,524288 --field-trial-handle=2308,i,15335646008277465535,2626139671123493397,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,13057506593024242303,14592092610986022709,524288 --field-trial-handle=2308,i,15335646008277465535,2626139671123493397,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,429006761446378125,281187463701578374,524288 --field-trial-handle=2308,i,15335646008277465535,2626139671123493397,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,429006761446378125,281187463701578374,524288 --field-trial-handle=2308,i,15335646008277465535,2626139671123493397,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,4604727252527658411,7650930396692410996,524288 --field-trial-handle=2308,i,15335646008277465535,2626139671123493397,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,1334753709984837835,13363939636358175947,524288 --field-trial-handle=2308,i,15335646008277465535,2626139671123493397,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,8569574669837075709,1859032928683631825,524288 --field-trial-handle=2308,i,15335646008277465535,2626139671123493397,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,12802142560586475535,3347352148161790330,524288 --field-trial-handle=2308,i,15335646008277465535,2626139671123493397,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6028,i,5135478604862124232,14508032513864603221,262144 --field-trial-handle=2308,i,15335646008277465535,2626139671123493397,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 17d500b4417e92837c05a8187f43f060e09191612c25892f2c54e786bd254c36
MD5 ca52a84f03e904e79c2a5651b273e5fe
SHA1 61ddeaf1850d81986389db97ff9470b67eb8cb1d
SHA512 d1f489b74d4da21280e354fdfd91d6569edfcb1abc7f4f6740756bbe744f02bd51136d5ea47c7a6a1842683dc3eba0d2608d4d46e5eb8ffb5035ffeb98f9c788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7G:fwUQC5VwBIiElEd2K57P7G
TLSH
T1B9B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a6e2a8912e78a57ca6d64fef7cd9d7995bc4e8495ed9fd6c077fc7774717d081
MD5 67d2672f887dd6ce2f1703a6e864a019
SHA1 990925a264c79f5a5bed4550d63d8ba55b9bf8e1
SHA512 a0159c61b9d7b34622949077617390caca096641c163d330d3c7399d8aeafb18c1eab2d59daab0219e914d6c3a2b4bbf092a621fd82b363b57746eb1371374e1
TLSH
T10F612AE405028993EF2D8DB0D0B21272B470B7B28AC70FCD01501BBFE69A7264D57718
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a64d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a64d.TMP
Size 3KB
SHA256 753709d4cb9cce94f3f3057b6d41948b98d06d17b0bba24ab529d29c1b440ad9
MD5 a1464244cf473b18db525f71e5dbeaac
SHA1 eae38ab62e9d1bef4df7556f644f7d99b0a17adc
SHA512 4de6e90ac168c0b1c3d1fd389a805029d349bcf73cccc5796b6f7db680cd79a1b542cd31bfd43d4f3cb79fee05242c3d14b1a088f3fa6b17c82579051355c981
TLSH
T155613BE405028993EF2D8DB0D0B11272B470B7B38AC70FCD01501BBFE69A7264D57718
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 6178281df6e36741cf5fc0790787a9de284d984938d8e2154cf06b095306773b
MD5 d4f789ae1d3cfc750a71711e9f2503a5
SHA1 24e16d98f7b5bcfa2f30f24ccb911ca4da84c5c9
SHA512 09e97731412e2626a1e4b265708c8f6d05eef82cff806da5333ecc28cd69229455025e19b5a138480d508577cae0f47b1fca3afb6646e9356b6246c8330f3214
TLSH
T1D1115BF7C3D5956E8A0156F05A28AE2BCE2D0606421C7C1989D4FF2793E3475E10155F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8df9570665c642ba3c67611c27a58b3f8efa42a77a1a497998ff0385f8e0505d
MD5 52a8ad73a5a7132579532112a0025475
SHA1 acabe2c042a46e30270c95a97525a2a3a2216e1b
SHA512 7932dec3f336092a083b0ff53df32959e05aac6c5213d7d031566c5258739df0aeeaea025d2986b127a7427c79fa594f721987f6fe2ecc9bc26a0a29ff92ec35
SSDEEP 192:sxZZykRUUyM/jK1Ml8MkkM/fEmszTZUpIdpJZfHW6+WNGYLzZDgCil6OIgrJ:sxZdjMT/f3szTxjHbGV9
TLSH
T1ED42F9116B34A977CCDBD209FA45BF53D6FA1472A2900E44A9FCD91C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 66568cba09d719da9bae05ce5fcf7a45a4c1361f48af59d0a3c48ea31a2e90d7
MD5 7b8d3e6faad19cfa479c4f25bc0eb306
SHA1 c11ea5a70ba73c2d40ca73fa57e0c10482255a0e
SHA512 9c15ea30d579ec3abd19349926799d3d96e0a31aea77d8ccc9c7073edbcaddf929d02b475146b84f62d1410c91fae9c67e3e486ec98ae8a8c42b96946bffe372
SSDEEP 192:sxZZykRUUyM/jK1Ml8UQ6kkM/fEmsfTZUpIdpjZfHW6+WNGYLjZugIil6OIg5zJ:sxZdjqJT/f3sfTx1HbGk7
TLSH
T1F452F9116A345977CCDBD20DFA45BF63E6FA147392900E44A9FCDA1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 78be94ba49d8e3c29f245e69a94e19e12fe3b339561674a46071cea4ef0aae14
MD5 6cf2b38c01d82410d33292dfb1cd274b
SHA1 7d93614c7a8630e438f1373d48df7d8a2d15b06f
SHA512 b76340d1ba44b5c6f969eaeadf25ccc9b4c5a483605ab2c3526f6d73ce7588d1e3cc83a70b0beb64408ed799fabec171e7b8f54209984ab775b70c1ef0b0379b
SSDEEP 768:u4s6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNArobT:u4s6pD1WvxzWju1jahILIsNLbT
TLSH
T112D2FA3B680CCB7E4F840E5CEC2AAF967DD801CBAB98895447FA454C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 51b68c8b91ef2a4cfcd9c1f14f86aac2ffd07f7b5acca087a713928e46119c04
MD5 85b2603ec067bb5ad9d8afb1764897d1
SHA1 fc4952a00e84386731c4bbbb0479d64b5bc11a0f
SHA512 2a2afd58d4c723b97ea7145b48c7a415b571d26ff4118c290f3268136753b32298db6fe2eeefad7447c7cdb60917a8c3a6f52f128606f676e3302e4c550739a5
SSDEEP 96:KUAAKtePW7iKEM+qCZ67g86wQx5cpszExKL4zaxviqREQSKkwKZiu7:iihRJ67g86wQvcpgE24zaBiqREQSnx
TLSH
T1B5D1F41672BA13023D7E2A4C83D497678AC272537414A42B3BAC04B6DD67E21CEFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 3133351b4ac3c7c1c944a13da02524a2cddbbac869ae275a08442d02f4d4e4e0
MD5 f7e82faa37e708a5e9d762db416a66a8
SHA1 9808af60b51afd80afcfd898cf1ca382a5b42c58
SHA512 5be90561a9327154ea1aef540b7cc8018ba9a1e2e021fac1d908b8e1abd9f51d793f63ef2f4c12469e503ddd8f8e537b38eff4b64077f1167b4955f2d446ee77
SSDEEP 384:pZcIhsN7vroR8Y+Ga9xO7glzJrWIYBeRs9JKgqijUMhOGGPL:hh3enDO7g9hWIYTjKgqmUMhOGGPL
TLSH
T1A2928D7058389D7799F3A581F98636278FF98037E6C52F90D1ECAF0D01DB99C230A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a78428af90be0e3e95ada6f1b2a7a3b26715f8570fe3be0c02a3c7aa120232cd
MD5 4079be5717dab0ea551a54e8f652a4c6
SHA1 9cf3efc7ee89a82045130bc586e91ad397016386
SHA512 ed12ebf366e152bd32fec163802744c1b7cde3b0714ebf7063784525b5efb940d9759259d1fc4fe94ff7f19124c8ebebc2b7daeadfacf9b1453cc6a585bd14ba
SSDEEP 192:qONx6O7+3hQmiUyZ0ZnjGttb0gO2VoIgGuvymU6:qONx61bjGt9xO7+KU6
TLSH
T1CD02F7356C686CB79EF2AE45F98737279FA9103BE9922F40D6E81E0C00D765C2347827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 013f5fe979f83246805a42bd953b162a510d9559d672056ceaa1a996e0324f99
MD5 6350f6936ac2dc785a82cf9fcc283308
SHA1 c9ee19ea716416d9714becd4e35dedfdb6ab8e6e
SHA512 6c697ed371ec9a04dadf419d6b29e0b58b9b85dad91b28c433349c79e6ecf359f4957965fd78f1a23afa64b9b761e4c0abb73ec8938519544667598dc6b220a1
SSDEEP 384:lZcIhsN7+roR8Y+Ga9xO7glzJrWIYBeRs9JKgqijUMhOGGPL:dhWenDO7g9hWIYTjKgqmUMhOGGPL
TLSH
T18A928D7158389D77A9F3A581F98636278FF98037EAC52F90D1EDAF0C01DB59C230A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 276c5f4c07e0b86230b05923a3cdd6a2cb49afb12177fae599c51f9b94b8ab7d
MD5 8761ddb5c6a921c3f34a9c6e2874ed34
SHA1 848725574002fb32e6ceed346d3693c6dd31a23e
SHA512 44d113e054015c18d644bf180d7c67a68337b11ae412c3c57f12994757d8b0ed7180a902542317cf4eee4f30511794607d64683c6f1f06e9748c04e37f099d07
SSDEEP 192:YSONfW6O7+3sJQmiUyZ7Znjzuttb0gO2VogHF0SJrNY6cNuvuqUmU6:pONu60cjSt9xO7glzJrWjYU6
TLSH
T187121B357868AC775DF2A145F98735278FA94137EA8A2F80D1DC6E0C01EF6AC234AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e616652513c8482e4a600bea5ae7dc477cfcdc0dc22cf5c1041193e55d4766d6
MD5 ca21d4a423c8f50ff863fd65617faebc
SHA1 0784713a2bac7bc20ece5fe2b7de7251762e06af
SHA512 50eabb1aac63a5902b12b1bfb8b7657e9efaa25c8d3247e028cf08bb6b068b58407b6f402e582c99db052ec72cb8cf9eccdc2887a6973338b7952edce1db70c9
SSDEEP 384:OZcIj6zsN7vroR8Y+Ga9xO7glzJrWjYBeRs9JKgqijUMhOGGPL:se3enDO7g9hWjYTjKgqmUMhOGGPL
TLSH
T1AE928D7058389D7799F3B581F98636278FF95037EAC52E90D1ECAF0D01DB99C230A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fddbb0cd-a3f4-4d38-8a99-5335771560d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fddbb0cd-a3f4-4d38-8a99-5335771560d3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1bdc07ce12df7e438cf04a3894b331a47fb3acc7f2e8aab2e547629fcab34e91
MD5 9c1204982e5fbb49dc227686cc348968
SHA1 4f82bbd511dfea1f171fff83d224d1381dda7073
SHA512 61377c64fc4ff2ab2b368b6b57e3220e492a664ed7a78ac44c9c5634ad33bfc7fd23410f2848ece078fb2f557eba179dd1a28051781e0ca829d9625fd108323b
TLSH
T16741D65CA6FD1158B3B36E569BF2686D487FB9272E06D46D10110E4F0A62F40DC62B37
MD5 SHA1 SHA512 TLSH

Submit Download