hxxp://ttps/visualizacao[.]gerencianet[.]com[.]br/emissao/697604_11669673_FOLA6/A4XB-697604-11718472-NAENEM5

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://ttps/visualizacao.gerencianet.com.br/emissao/697604_11669673_FOLA6/A4XB-697604-11718472-NAENEM5
Sample260806-3rewbach69

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
988	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305334849557320"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{258B54DF-0D5B-47BC-AEC3-5FC603F774F1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
520	msedge.exe
520	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2492	2180	msedge.exe	86
PID 2180 wrote to memory of 988	2180	msedge.exe	87
PID 2180 wrote to memory of 3512	2180	msedge.exe	88
PID 2180 wrote to memory of 3512	2180	msedge.exe	88
PID 2180 wrote to memory of 5044	2180	msedge.exe	89
PID 2180 wrote to memory of 5044	2180	msedge.exe	89
PID 2180 wrote to memory of 5044	2180	msedge.exe	89
PID 2180 wrote to memory of 5088	2180	msedge.exe	90
PID 2180 wrote to memory of 5016	2180	msedge.exe	91
PID 2180 wrote to memory of 5088	2180	msedge.exe	90
PID 2180 wrote to memory of 5088	2180	msedge.exe	90
PID 2180 wrote to memory of 5016	2180	msedge.exe	91
PID 2180 wrote to memory of 5016	2180	msedge.exe	91
PID 2180 wrote to memory of 2484	2180	msedge.exe	93
PID 2180 wrote to memory of 2248	2180	msedge.exe	94
PID 2180 wrote to memory of 2484	2180	msedge.exe	93
PID 2180 wrote to memory of 2484	2180	msedge.exe	93
PID 2180 wrote to memory of 2248	2180	msedge.exe	94
PID 2180 wrote to memory of 2248	2180	msedge.exe	94
PID 2180 wrote to memory of 1308	2180	msedge.exe	98
PID 2180 wrote to memory of 1308	2180	msedge.exe	98
PID 2180 wrote to memory of 1308	2180	msedge.exe	98
PID 2180 wrote to memory of 4596	2180	msedge.exe	99
PID 2180 wrote to memory of 4596	2180	msedge.exe	99
PID 2180 wrote to memory of 4972	2180	msedge.exe	100
PID 2180 wrote to memory of 4972	2180	msedge.exe	100
PID 2180 wrote to memory of 1056	2180	msedge.exe	102
PID 2180 wrote to memory of 1964	2180	msedge.exe	103
PID 2180 wrote to memory of 1964	2180	msedge.exe	103
PID 2180 wrote to memory of 1964	2180	msedge.exe	103
PID 2180 wrote to memory of 5088	2180	msedge.exe	108
PID 2180 wrote to memory of 5088	2180	msedge.exe	108
PID 2180 wrote to memory of 5088	2180	msedge.exe	108
PID 2180 wrote to memory of 2068	2180	msedge.exe	112
PID 2180 wrote to memory of 2068	2180	msedge.exe	112
PID 2180 wrote to memory of 2068	2180	msedge.exe	112
PID 2180 wrote to memory of 2924	2180	msedge.exe	113
PID 2180 wrote to memory of 2924	2180	msedge.exe	113
PID 2180 wrote to memory of 4260	2180	msedge.exe	114
PID 2180 wrote to memory of 4260	2180	msedge.exe	114
PID 2180 wrote to memory of 4260	2180	msedge.exe	114
PID 2180 wrote to memory of 964	2180	msedge.exe	116
PID 2180 wrote to memory of 4068	2180	msedge.exe	117
PID 2180 wrote to memory of 2520	2180	msedge.exe	118
PID 2180 wrote to memory of 404	2180	msedge.exe	120
PID 2180 wrote to memory of 404	2180	msedge.exe	120
PID 2180 wrote to memory of 520	2180	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ttps/visualizacao.gerencianet.com.br/emissao/697604_11669673_FOLA6/A4XB-697604-11718472-NAENEM5
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff95724c188,0x7ff95724c194,0x7ff95724c1a0
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,5714804569495665987,7528127728356231884,524288 --field-trial-handle=2468,i,5642985284527888520,12342788394868297551,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:3
  2⤵
  - System Time Discovery
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,12989965361139472029,13296724887505596866,524288 --field-trial-handle=2468,i,5642985284527888520,12342788394868297551,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,15066154399433132447,8978111060608365554,262144 --field-trial-handle=2468,i,5642985284527888520,12342788394868297551,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:2
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,1643261315483010093,7860528211606652051,2097152 --field-trial-handle=2468,i,5642985284527888520,12342788394868297551,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,4911915705729011254,14037037588864603021,2097152 --field-trial-handle=2468,i,5642985284527888520,12342788394868297551,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,11152123053106815085,12566220594010871071,2097152 --field-trial-handle=2468,i,5642985284527888520,12342788394868297551,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,15300160049943009169,6700796496822087245,2097152 --field-trial-handle=2468,i,5642985284527888520,12342788394868297551,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4968,i,10973373809207323485,9192775580563099349,2097152 --field-trial-handle=2468,i,5642985284527888520,12342788394868297551,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3488,i,4075635539025425200,14056027126571286935,524288 --field-trial-handle=2468,i,5642985284527888520,12342788394868297551,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,6185177152107471928,10969166723676827740,524288 --field-trial-handle=2468,i,5642985284527888520,12342788394868297551,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,17685469205968754784,16621308956464228600,524288 --field-trial-handle=2468,i,5642985284527888520,12342788394868297551,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,17685469205968754784,16621308956464228600,524288 --field-trial-handle=2468,i,5642985284527888520,12342788394868297551,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6188,i,16578806208588181805,1349546322332889492,2097152 --field-trial-handle=2468,i,5642985284527888520,12342788394868297551,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6444,i,6154550612314279830,9761645947288503262,2097152 --field-trial-handle=2468,i,5642985284527888520,12342788394868297551,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6384,i,125797215884114514,3536090584006173896,2097152 --field-trial-handle=2468,i,5642985284527888520,12342788394868297551,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,1104482355448486563,806689693418194629,524288 --field-trial-handle=2468,i,5642985284527888520,12342788394868297551,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4456,i,2338374302542682999,1936439137777687696,2097152 --field-trial-handle=2468,i,5642985284527888520,12342788394868297551,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,1076030984821649069,16688720013784934580,524288 --field-trial-handle=2468,i,5642985284527888520,12342788394868297551,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,16761825365234137427,16042363116139333055,524288 --field-trial-handle=2468,i,5642985284527888520,12342788394868297551,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,248048073963627755,16214700992986771098,524288 --field-trial-handle=2468,i,5642985284527888520,12342788394868297551,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1008,i,5291394086544393002,10455517094687088246,524288 --field-trial-handle=2468,i,5642985284527888520,12342788394868297551,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6340,i,3244270654350772667,8640550115237311740,262144 --field-trial-handle=2468,i,5642985284527888520,12342788394868297551,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
Size 68KB
SHA256 9e4788840f43b463a51534f036f6bd9a36e5293bd6da8e4654b43e1d83714d81
MD5 0032df338799c529f8900ed1df3fe473
SHA1 3552463fe133dad96c5fbb369d3225e51f729c51
SHA512 15265ff935bcd4e70263c233fcc97185785291a454838bde98267e26dc2143af16720dae70710ff0149a783ffa484ca7478ae76fc451fe2743c2c1069d7b04e0
SSDEEP 1536:U6UIpg9QPWEgHpuRQAPmrc930G+7F4rwzk50fpuMSKlZh:U6LO9AQy+GnSfDS+Zh
TLSH
T12863129CB8B56F8C40B28EB153ABA01DD306C65DC47B93FAC214B64F029D129A43769F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
TLSH
T1055302E4123CA75C49FC43EA5434D635BA4B31ADABD4102FB69BC4258F6EA824447CFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 37KB
SHA256 84186c94c202c6eaa8cdde14e8bcb82ae95f13413df2852b46bd013535425f4b
MD5 8abcb03d6ce0af82f0e2048c440e6cae
SHA1 b35be41ea1f9cf3fe270d01ce78b4b121f851ab0
SHA512 b6ea20bd67cd7fab5703a0e980ff2e338f195fb851cb6eb511c1e750e193d2887580fc998e5c7dad92839bf2ee6209498ac6f9a6aae81fa1f168784bc2085067
SSDEEP 768:frn6Vqe28sAmi/PwOzwOqHgPrzb0JW1bZwcP5TnHak8yIpxTkHDVChA28g:fOVidcwovb0JW1ySnBEHywhJ8g
TLSH
T1E703E173136772151FE5533BFA9B820D4208A78AC06F438D384965F96E7EDA9003FD68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 75746eebd90dcf7584c9561e3244c9a3431787ed700e7f9a8c602d4b7f4fb1fc
MD5 961ad5a7fd4fa8a0357d67d38aba3d63
SHA1 6cdd57ff8024c53de551605a602e05d26ac1829b
SHA512 63ad268b46c1731eb902f9b6a2edfda7097cb064a2fe3c18085909b27d683e3c180f51e725bf2eace137b8f5cc54ce4f20917ec01d23df87bb7d054b7101025d
SSDEEP 96:EUEFAd5ut8SJSvecZ6zAsVEcGnoS0PDv7W+vZbWNH:0/QsMoSONQNH
TLSH
T1A1C10A3AC2A208B6D79984BBC0F232A03977B5D6F4531E8933B2BC736535B10A59C43D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f1de61d0242245b4c54c3c0e31d45df2021457694272c60218e8a5f127946729
MD5 1bb6e4ed8c48d90fee9e5e401b759ecb
SHA1 1a43695ca3edbabf3c2dbe74ab732b4a13ec243b
SHA512 9db54057d3adc96a1f69a5a904c77a8e52693ce4da498e58b169418390fc5c1c7015ef7736f2efa24d75dc47e5182c988874fc0778507e729024b645b200e4e1
TLSH
T1FE417CF3C7E5826EC91112F09A187F2BCE1D0946825C7C56C5D4BF5B93F2071E151AAE
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 fcc679a73720eeb84aff53d9fd56993cc2cd3fb95b941c54e5fabcafc3cebc5b
MD5 ed72371f0456dae75bed4a177dac33f4
SHA1 a0d33a5c195bc37616dcb406fed64edace8fded0
SHA512 57258e95cec032b722f1d81bd82f9f9472a980be91b418f70bba7cdc0ed4047add2eb035f5152bc6198a2b9a750ec2dd0b1f7c3088800ee83073ed4c3d6e9743
TLSH
T1D8D022631206B0B8A59D7EDB906EED8FC32B1027090AAEE512D05D9C0D3686D092714E
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58afa4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58afa4.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7f78fc85999689711891415c417839c381d230e5c00e7c445853c03d320dc2f4
MD5 68a5cf5c947c501bddca4df2378ad781
SHA1 9944f9a90a047175bf0e420b245bc8a4651fa716
SHA512 eb7f4e95b9ee03bbfb8b5bfd9fc26f764ff12937044eb2cbd328e5bce211c9f930e41aaac29711eb44ee7db0b7c1c22291d9bfa605bd2a671c239d4b6001b096
SSDEEP 192:sxZbRgyM/jK1Ml8Mk//fvsCWwNdpTebNHW6+WNih2/YIlboxIgrJ:sxZbiM//fvsC9hCHbR/q9
TLSH
T134520912AA346977CCCBD309F945BF93D2F45572A2944E58A9FCD91C04E7AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 3b2550204077f19fac97959d6a46fbcfcc28be92530a0b914c2d92d8fedd27f4
MD5 e222a394de9204d1ff065a3fded6393d
SHA1 3976dd80a5d47955b9493c149726db84375b4b1c
SHA512 d262a84b73832270effbb27cd504f35a1336bc4f40630048abca69f9852e2b4cdf8222d1aca229a1f19e07188691110a3496648d0f9b21b5fe36d004819adcd4
SSDEEP 192:sxZbRgyM/jK1Ml8UQz0cB1//fvsV4wfEBdp9Qb8HW6+WNiNzfYIk2axIg53mW66b:sxZbKqwm1//fvsVPfE1vHbgfU2R9lg
TLSH
T1DD720852A624D977CCCBC609BE347F52D6F5046399554E9C6AFCD90C00AAAFD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 428474c3670ad1ab9155313ed200a19c04d9f96e70320793c0f4fe46aca925dd
MD5 3e6836643ccfbdc389c0cded295f3541
SHA1 441d19ac162a5280893853b708be6116fbcecaec
SHA512 d8f29f5ef33a75a135358b57691f50696d78640a0bb879ef9be8803cb47751a369f7673c159e2766d21844db7366c29783cec402412fb710ebc4a35e60877874
SSDEEP 192:sxZbRgyM/jK1Ml8M0cB1//fvsVWwmOaEBdpTebNHW6+WNih2/YIl9oxIg5dGH6eU:sxZbKsm1//fvsV9mOaE1CHbR/o2HR9lg
TLSH
T16372F852AA24D977CCCAC209BE347F53D6F50463DA554D9C69FCD90C04AAAFD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c592eab4761031fd68a44a69a2bea0a1c1c9416b075202ed643628a81a50c7e3
MD5 e50d9dbf9918a292eae29968029ed166
SHA1 13e277f65982a1163ef7bd7c191c870d1d55f74d
SHA512 03d3a081bf4d62e69161d5010058f66aa3ab247ed044089e19b044e13e10b6729105d17bbdeaeca75cb7b96bedb3a33587fa543fa8125427d80f24d3976101ea
SSDEEP 768:vZJsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9/Crom1I:vZJsqxXlWvJD6Tu1ja54LAs9/ZmS
TLSH
T124D21C3B694CC77D4F840E5DEC266FD76ED801CBA6988D5447FA880C03C72EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 9097ae474c09fadb0d50075bfc1d2b801a25a8c040d1ea254e7f29de92fd31b9
MD5 998cc0431783add6f2fdadb89990843a
SHA1 acdd03b808061124bf56027fea941cb3f24dbf3f
SHA512 10c62cf3c056e1ffb887df24ba1e3a54f361803d079de9ffadb8466cdb316440da62a5b648865a70d5d27a03ae64ff7141c9db9a608da780da5e9b1bb72b899a
SSDEEP 96:KYbaKYIK6m0Knq6+HuKYYj5uKiYCiE4KxCt:ExX/l9Zfq
TLSH
T100E10302717F02033ABD7908A3AA89374E4276A37458A4BF3B7954624EB7E111DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3b58dab-c0ec-4169-89dd-482023ef5c50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a3b58dab-c0ec-4169-89dd-482023ef5c50.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 bed750425f7690e615c7011b7846ca22540e7f25dc708ef076acdb78a4d5b2aa
MD5 7df28ad41e07cc7cedfd3545139d06b9
SHA1 c2866ec005c6830f70ccf7f17fae0c4967f70f44
SHA512 9219ec027ae84d972eba1cf08d601dd3d80e72002f988723904f2288412c9473691c1ac8a03c213b01f210a85ab355433eaaba47df0fc8fc6bb06534555a67bf
SSDEEP 384:/ZcIhsNepCIY3b1+eVRNwOWG9JUfZPDpOjRFIUYBu1:XhrncHwOp9OfZUdFIdBu1
TLSH
T1D2927B7258755C3B9EE3A555F84B36139EB89073EA8D2BC4D1DD2F0D01DE9E8130A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3b60c5db0b2b5421b7a5827526e4e2a2ae51f26198231f8965580a4b878f6e1a
MD5 32b324a72b998d7b1348491b58cca2ea
SHA1 0eea661519a0d6ee0651e412e706531fd6433e75
SHA512 ca902fed68a427107116e3521281d5474475af5b65958f2c48cd00ffaa171e10401753a386f9b8e2c740b174c9e15a564c3975d4e2cbf413e0f6b293dd6c664f
SSDEEP 384:TiFiZcIVzsNu8TUNTUlIlICIY3b1MeVRNwOWG9J5fZPDpOjRFIUYBu1:+FQtzwgaJcHwOp9zfZUdFIdBu1
TLSH
T1FAD23CF248E7483ADAAE5747B77E3D134DBCD063B5896A90B3881A0CCC9A5BFD305815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 31838be63c13aa99bcc59ac99099279d79d3f4d8ea837742fe224de1ffca0d04
MD5 1f4bf8ee35518348ff68e7caa44bd563
SHA1 b429f88f994aa19f47861b2c69e2c9a793314003
SHA512 cfcb2a0f5918c9e7e01635e1af28a188943c37d44834b0b22c594ecc43744e73dbe81d5ac0680d9e96a3a0469d7bd661547971c470d932784e39956fd593d063
SSDEEP 384:tZcIhsNeICIY3b1SeVRNwOWG9JUfZPDpOjRFIUYBu1:1h2jcHwOp9OfZUdFIdBu1
TLSH
T145928CB258345C3B9EF3A555F94B36139EB89073EB8D2F84D1DC2F0D01DE9A8130A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a29a6a7b38fefac4675b2fcf6d874553db4232dd19e723b7536d7d48669df7e0
MD5 3a2f377d11b4e2dee1b779fd07622b56
SHA1 1163434b198d79f148b7b1ed2d8f98aaf660c13a
SHA512 cac451168a752a672575daf86b8536a5311195a203557e93e86688dc672c26f4ca7243cd2a267382c52b97d65746191a01d3d29699469c12a89b1ff964e2605e
SSDEEP 192:tONg6JkRtQmiUylzW+RNwOmhOmQh3xjRQU6:tONg6Ur2W+RNwOW0AU6
TLSH
T14402E9346D382C779EF2AE09F54B27135FA5113BE9852F84DAD81F1C01D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 27c0288c5bc57fa8d2265778b1895580228a14166fb626d7f938ff024abf33d2
MD5 756912da0aab5ea1004f9c52185e14cc
SHA1 6288aad8e700cb5ac35385dce3eb1e0b8cf2b6bc
SHA512 7a8a5336a00e2e0f131b1c227c077feb387835c1ea62e607b883ec9cdb8a8082e19349421f4a0268a2b7a6dd1f9a39161d6134789e267e16e19dfb18c52e64fe
SSDEEP 192:LONf6JkRcQmiUyQza+RNwOmhOmVU9DFmVcxnq3yvU6:LONf6Usna+RNwOWG9JBfU6
TLSH
T189121A3169385C7B5EE3A945F58B36134EB5412BEA8D7F80D1DC2E1C01DFA9C234A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4d6a0f17a33acffcce5da2e5662832b21a0c50384ab8203bac345954d0e67fd7
MD5 64ccb6d168fedf21fe7e4e070a11bd4c
SHA1 b86a50243a4c32536eec5db7fa6e6393c67583bf
SHA512 66d0e29817389e9031877cd601c24daa275f375d4dfbec1ecf3700aca0a4d4c31536778016ada488a7fd78bf41d2ab527f3fb19eba9de3148f3404822d7b8b08
TLSH
T15041B66CA6FA114CB3776F5AAFF6A86D487FB9772E46945D00010D4E0A62A40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download