hxxp://br-rio-anx-r007[.]router[.]teamviewer[.]com

Analysis

max time kernel
899s
max time network
605s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 03:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://br-rio-anx-r007.router.teamviewer.com
Sample260809-dt9q2agq21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1508	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307191816461383"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{83E6FD65-93E7-4338-A7DA-C028233B3837}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 4436	1264	msedge.exe	83
PID 1264 wrote to memory of 1508	1264	msedge.exe	84
PID 1264 wrote to memory of 4364	1264	msedge.exe	85
PID 1264 wrote to memory of 732	1264	msedge.exe	86
PID 1264 wrote to memory of 4364	1264	msedge.exe	85
PID 1264 wrote to memory of 4364	1264	msedge.exe	85
PID 1264 wrote to memory of 732	1264	msedge.exe	86
PID 1264 wrote to memory of 5056	1264	msedge.exe	87
PID 1264 wrote to memory of 2064	1264	msedge.exe	88
PID 1264 wrote to memory of 5056	1264	msedge.exe	87
PID 1264 wrote to memory of 5056	1264	msedge.exe	87
PID 1264 wrote to memory of 2064	1264	msedge.exe	88
PID 1264 wrote to memory of 2064	1264	msedge.exe	88
PID 1264 wrote to memory of 1032	1264	msedge.exe	89
PID 1264 wrote to memory of 2292	1264	msedge.exe	90
PID 1264 wrote to memory of 1032	1264	msedge.exe	89
PID 1264 wrote to memory of 1032	1264	msedge.exe	89
PID 1264 wrote to memory of 2292	1264	msedge.exe	90
PID 1264 wrote to memory of 2292	1264	msedge.exe	90
PID 1264 wrote to memory of 2848	1264	msedge.exe	92
PID 1264 wrote to memory of 2848	1264	msedge.exe	92
PID 1264 wrote to memory of 2848	1264	msedge.exe	92
PID 1264 wrote to memory of 2356	1264	msedge.exe	100
PID 1264 wrote to memory of 5044	1264	msedge.exe	101
PID 1264 wrote to memory of 2356	1264	msedge.exe	100
PID 1264 wrote to memory of 5044	1264	msedge.exe	101
PID 1264 wrote to memory of 2716	1264	msedge.exe	103
PID 1264 wrote to memory of 5056	1264	msedge.exe	108
PID 1264 wrote to memory of 4892	1264	msedge.exe	109
PID 1264 wrote to memory of 636	1264	msedge.exe	110
PID 1264 wrote to memory of 1936	1264	msedge.exe	111
PID 1264 wrote to memory of 1936	1264	msedge.exe	111
PID 1264 wrote to memory of 1748	1264	msedge.exe	112
PID 1264 wrote to memory of 1748	1264	msedge.exe	112
PID 1264 wrote to memory of 4600	1264	msedge.exe	114
PID 1264 wrote to memory of 2332	1264	msedge.exe	115
PID 1264 wrote to memory of 2332	1264	msedge.exe	115
PID 1264 wrote to memory of 1608	1264	msedge.exe	116
PID 1264 wrote to memory of 1608	1264	msedge.exe	116
PID 1264 wrote to memory of 2588	1264	msedge.exe	117
PID 1264 wrote to memory of 2588	1264	msedge.exe	117
PID 1264 wrote to memory of 4548	1264	msedge.exe	118
PID 1264 wrote to memory of 4548	1264	msedge.exe	118
PID 1264 wrote to memory of 2356	1264	msedge.exe	119
PID 1264 wrote to memory of 2356	1264	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://br-rio-anx-r007.router.teamviewer.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffe8275c188,0x7ffe8275c194,0x7ffe8275c1a0
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,6793621189492364154,14033824240193181706,524288 --field-trial-handle=2368,i,12918321184016041969,17105127385014484937,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,6753591699108940239,14612308700528516416,262144 --field-trial-handle=2368,i,12918321184016041969,17105127385014484937,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,5290087794994281360,1493812308013146280,524288 --field-trial-handle=2368,i,12918321184016041969,17105127385014484937,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,7578101759557058953,14746422216128062693,2097152 --field-trial-handle=2368,i,12918321184016041969,17105127385014484937,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,11063826084483005864,12367113212848968838,2097152 --field-trial-handle=2368,i,12918321184016041969,17105127385014484937,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,2664704396937738572,5508681488855472975,2097152 --field-trial-handle=2368,i,12918321184016041969,17105127385014484937,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,8713299170200085121,9996111609930205981,2097152 --field-trial-handle=2368,i,12918321184016041969,17105127385014484937,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5060,i,6754409975086258402,13530487042594576897,2097152 --field-trial-handle=2368,i,12918321184016041969,17105127385014484937,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,14565215668082330012,17901151921596054007,524288 --field-trial-handle=2368,i,12918321184016041969,17105127385014484937,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,9707316964405438369,2482475230564581428,524288 --field-trial-handle=2368,i,12918321184016041969,17105127385014484937,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,11924362559077539040,12986371640932511764,524288 --field-trial-handle=2368,i,12918321184016041969,17105127385014484937,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,11924362559077539040,12986371640932511764,524288 --field-trial-handle=2368,i,12918321184016041969,17105127385014484937,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,8529416798269235561,17733030683008540932,524288 --field-trial-handle=2368,i,12918321184016041969,17105127385014484937,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,4640434608695730879,10263124710236160992,524288 --field-trial-handle=2368,i,12918321184016041969,17105127385014484937,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,11755571764335316752,15689786937423658683,524288 --field-trial-handle=2368,i,12918321184016041969,17105127385014484937,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,11478803377776098356,9034100611918967699,524288 --field-trial-handle=2368,i,12918321184016041969,17105127385014484937,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,17106195833391858423,9361875921798029941,524288 --field-trial-handle=2368,i,12918321184016041969,17105127385014484937,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6108,i,10005633884436364163,15919794618549358599,262144 --field-trial-handle=2368,i,12918321184016041969,17105127385014484937,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3992,i,18306240775697877563,1368753073391526446,524288 --field-trial-handle=2368,i,12918321184016041969,17105127385014484937,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3952,i,12448608142081293684,11591593289896128425,524288 --field-trial-handle=2368,i,12918321184016041969,17105127385014484937,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2040,i,18155860710714781863,1458548944457352545,524288 --field-trial-handle=2368,i,12918321184016041969,17105127385014484937,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3372,i,2839816765867446539,2846850667701643082,524288 --field-trial-handle=2368,i,12918321184016041969,17105127385014484937,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,979702242371827660,10894786615889396542,524288 --field-trial-handle=2368,i,12918321184016041969,17105127385014484937,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:2356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 ca774e5ed7e630ee5a963d563f9f01c9fb642b1ae6331a43d4a0dfd03482a89b
MD5 a7a4c62a693cf5ed84910081a6608ff7
SHA1 bf792e7991bd2d9838390b01329279007c87e9d7
SHA512 1bbe5926662fdf54d905e0ab8a7169d9d9e406ce80d6199a778e1cf6baebd1b53dbcadecb7f3e8674037554df06bdf5f7c6dad5d4fecb8f6f0c83a4f85b202e5
TLSH
T1A1E0209829C4C21D7940B44B61784B0CC1C13B0E9BD4E9492708884D7102040F3D5BE0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 53574508af6b53f836dc1c5d14afe419d187917a6794afa9b784e750b53eb611
MD5 9f01ab8ff143bfc65f84c6e68821dd98
SHA1 ac370326830649c631b2180ff9c44159754ca8fd
SHA512 8d8a5d0b55e84ece87f3690eebc974eadc4de4d5ad41fe6f0512777c0277a8a1c85686a1b5e2b53f53335f830be3824d94943dd0fe166857282c79db0e3ababc
TLSH
T11AE026CD94DCC22FA684A44762685B0CC3D03E4F9FC8E9CAA700C48D7302044A7E2BA4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 50456e2def0c9573a35e7cc42ecd909671aa4725f619f1837d18fa6093996066
MD5 2eaa5980d912c564e6ebeb34d29d1eed
SHA1 d9934f500b5e3865e529adb7c7ce0196c2f70526
SHA512 1eeabdc79a2d1328db5a4a2e21c36af14891a59ecdf65fcd782e51b1fb6ca0ac6d726091f2e812bdb1c5904e2e1549c42b6a6469e5aa767547e8f96a1724c568
TLSH
T146E026CD04ECC26FA654648B72A84B4CC2C03E0F9AC8ED8A270088887702040E3E2AA1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 ea509b75f0a09fa9c1222bbcf3abcc668940180bee299d69e674a967562c5089
MD5 b2e9f8d78673257f54bea032ac885705
SHA1 486783e9437a89c7d0b3ef128205dc60a8b4f244
SHA512 4843029cc2e0c251ecbe5d6ab0c1eb3b4e1c951e207bb6e60d236d921b31868bca503f3cc86c68324e424c4a3810a5ee274cb524db24887c231750d407a77878
TLSH
T1E2E026C904C8C26EF6C064DB63788B8DC3C03B0F9AC8ED8A2B0084887341440A7E6AB0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 92a62165a98e824553f2a864f629bbd54ca661f8c53c76b8e54996f8273074a0
MD5 60c56cd3ca2c3cda6c4cc4a5bfdc41fa
SHA1 2004d7c0104074c4d4af086f7d6a80e02274d42a
SHA512 4b48622732896e6bc458421bce25363c64cf08535cdd7a8929ef14da8072991eccfdc2cfa985e6c13a987df2d0f5a9532a4e73381c0e301349bb1c088bd7d866
TLSH
T1BC616EB0090FA7B9F30A50F153D21195343288DEFD432F34136AA8FA1EA430391D9F96
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2d40f544380f979b7f7a66f3d2e25d9a0936ce12ee2000b5ae6a1d4051353e9c
MD5 1eb219cd7396eda9fe70344cccd2c8e2
SHA1 e93512289edaab00371cd4e20172aaf38bea2d5b
SHA512 8f08ea1dd6e18e3ea15de1e0b9d0cb1d4960e2b8da104f81531ed07af3a18c8616667bdd871a8fb9152451d922f30f994a569a9b6904fb6314692ec21a715833
SSDEEP 192:sxZjR5WY/fysijIdp4y3HW6+WNGh4X/YIEPvjIgrJ:sxZjqY/fysi84YHbG2/o9
TLSH
T1F322C8526E386A7B8CCBD20DBA15BF53E2F9503291D41E58A6FC9A1C04E7ACD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9d023e0c224348a51a86f6653c04c0431e94032fcdec7f4cd8c89ad06cd0c0b3
MD5 231ce8fb485220afa69433f2e1bf8508
SHA1 2cce0a185f8b3ae534d18795412705fbd3ca9461
SHA512 a4b3d3e1a49bd84989a186be06236d60b712214eb25926a07da96ceb534a15dc4fa4346c1ffc7994d4c351ac0885654acdd47124e63f7152908377484d147ca9
SSDEEP 192:sxZjR5WY/fysbjIdpGy3HW6+WNGh4X/YImCXjIg5aJ:sxZjqY/fysb8GYHbG2/R4
TLSH
T15532D9526E346A7B8CCFD21DBA15BF53E2F5503291D41E58A6FCEA1C04E7ACE620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a162ea3342590f15d27958bfac40e6a78a2bc658a1b3b7788745afe1d45151a7
MD5 24342f6404054b7fcec91889bb9a5557
SHA1 4570ae9fabbfaadaaed8e2be56d05b7f1de811f3
SHA512 150cb9e6f9bc6df792d3752e2c77e34a5dae941528a01f1e63d3ed5756bb280752c281c42e2d32390099929fc469964c7953732774f19699ec1002f1b6c7036d
SSDEEP 192:sxZjR5WY/fysbjIdp4y3HW6+WNGh4X/YIWpvjIg5aJ:sxZjqY/fysb84YHbG2/S4
TLSH
T1A422DA526E346A7B8CCFD20DBA15BF53E2F5503291D41E58A6FCEA1C04E7ACE620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c8c7ebc76bb56f80ce5c71f3646116146af9604fe3872c5876b7f5fd03d8d6c3
MD5 95b6f0e1c0399add70bcdc78ea2b90e7
SHA1 05d332b0e68cf5029a71e27f5629363d960d9a24
SHA512 039b8b0b844fc3efe040f3327a34256e437a0f36f02e14ade0af6f308801694a8425d10ec8a9c96f0bb13210129e93549a0c6d521e819cafa94d0f71903e7c4f
SSDEEP 192:sxZjR5WY/fysOjIdp4y3HW6+WNGh4X/YIEPvjIg54J:sxZjqY/fysO84YHbG2/oq
TLSH
T13622D9526E346A7B8CCFD20DBA15BF53E2F9103291D41E58A6FCAA1C04E76CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b6ee1614fef97a6c720ccedfd4fdcc049e23f6f5ae3aabc4656157bdacb62deb
MD5 a7b6ca0dc68d7e6e6eed0a0adc62d0d4
SHA1 9957ad79e2573c9feee19ef048c0d221dbcf4cba
SHA512 4065ce129b5620ca16c6cbae56c65fc66cf6da44d430195d32e3c3b432f3216c2b796e0eabe702f7c354eb4ecd9118c040afcce562792507d45ab4da9be509b9
SSDEEP 768:DuyqbblWvJDjT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE4Ll6AR7orokN1:DuyqbblWvJDjTu1jah4LAs7Tkb
TLSH
T197C2F93B654CCB7E4FC00A9DDD5A6FD73E9802C7A6988D4047FA994C02C77EA512A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 720B
SHA256 f1dc026b24a042f09310256784d5cdec6cb2d6bbf6163f6ebf6656ce79878901
MD5 c021c0509cb0505916227a66188d1316
SHA1 dd2ec8b3d779c2d11f1c773e5f6ec3f19789e39d
SHA512 3e61fc21543f7b68d66b8751264e3e6e754f69b6942273cc879c9d1d6623a05255b73100f972f36b54a22fede479033ae05a41ffa04b8af28d11b357fa25af99
TLSH
T15601C0891EA05D2FFDA24A7314B420F0B371C9DC7B22D52B553D66273C2634965561C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c909f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe5c909f.TMP
Size 720B
SHA256 70361aba3fb49d1272a1da16cbf89445086c46fb320c6547fa0e0fd5270295e1
MD5 6114757f7ea07c817d38d7fcb068ad1b
SHA1 4071d8beb4829d350f5ea62b511b2b33b76a1989
SHA512 bac1b8dac375e55fd961e6df31cca66a4fdd789a8acbd6be2ea0edbc8266d2c4c369f39e52b449ac8d2cba02e652874a607da24df58b488eaf96f72784a60a55
TLSH
T152010E868AA18E1FE8914AB6089514F4B331C900A363E663607E692E6C7A78D69560CC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 222a839d77b5f209935074f1e53e37367a0ff71aa75cc73beb98ae8bfdd4a73b
MD5 3f9dcce61d6ded12ddca29195b2e794a
SHA1 733b8b6bfb8a169bba84afdba13c4a40cb13a99a
SHA512 1eef1d57fcfc2eae1957e352ed7bd8a4f6b38d1bd320e8e7586d3574e2e88c1dee9ffca38cac96a8d40d25c71f262f184b69cccab55ce74069a750e8f885dfde
TLSH
T120E06FBA6AE70800A8ABC3EF087294A60414F828CC91EC4F002A92C310622A02832C2A
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a29f0b9e84ff376b1002383c27c9028ed384b16163dc2023ee4bca9641823254
MD5 205985642fd6f797bff0376cbbb82ad2
SHA1 c954c46a7dfc2d42af09b359968780f8761b35ae
SHA512 75aa5f305cbf0a7eea1bee179b8ea48a96a9407f17c4dd32d098f40241de0dec0f90fa87903160e33c5b572b54ee949e379a633abbd3fb652f67bc0c4f6ae462
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyskHQE6SC2cS99IrE2KKTCm22smNFWky:KYbaKYIKmdCK+wSOneK8UJ
TLSH
T18991021A723A0283393E6848B36686764F4132633459A5AF7FB944714EABE134DFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 3d37a1820f388b64222e20e379a98d9f8a22278ec95ea4ea2902706efda299b2
MD5 761598b264d78f8ce34e2b6695026285
SHA1 7d699f0c2e4bc2a59e8e4a5a10de4f993fceea99
SHA512 c5b49b3e92f837216fd1dba653e7e7c0d6c75da823d2d0f2544e6dfc2cfa80c11285191dbdd59b045c93673af2fe7cf82cfc4acd40842deb912265215d46b529
SSDEEP 192:12LsNpxQK8wkRbWbQmiU1T1Rl4VRNuOmYx2j9e5SRIqAi2U8:msNpxZ8zbgbR6VRNuOPxQ9eA92U8
TLSH
T1163209367D386C774DE66544B58B36139EA8506BEA893F80D6DC2F0C05DF69C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d30d0fc1e3385f1e1b3480a7d5c7675e0bf7c130659331986a35300ab95b304c
MD5 1f9dbf3010baf987ece253be39859ebc
SHA1 e81f2e9a5fb094fea824a3f14cba8f247be6f481
SHA512 2fcf717b9344f3ed7a7d04a1f348cdbb1b9b3f0c3c07225eec1e919f30ba74bb3be4a8ddebd52f2bfeeb70f50b5af493f325ec90bd77d43a292cec9f4a46cf7b
SSDEEP 192:qlskzsNEeQK8wkRbWbQmiU1T1Rl4VRNuOmYx2j9ewHJRIqAi2U8:WzsNEeZ8zbgbR6VRNuOPxQ9ewL92U8
TLSH
T127420A357938AC774DE66544B58B37039EA8506BEAC93F90D6DC2F0C05DF69C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 35404df572b46b3e61f1036c6fdc513340d731f4152f1155f56a44160845e191
MD5 8eacd8553b4dbe3cb554cb499034a7d8
SHA1 594dee07132eb002a3ab0e43a8d3c3b3cea94b1f
SHA512 2dee632731b60926d354121b934eb6a1934d1da7c8c8af3c8a11213e8771a4468cf4fb575fffd01829b64f0d075d54c97ae51218ac0e01005963808eca15d229
SSDEEP 192:qlskzsNre/K8wkRbWbQmiU1T1Rl4VRNuOmYx2j9ewHJRIqAi2U8:WzsNreC8zbgbR6VRNuOPxQ9ewL92U8
TLSH
T1AC4209357938AC775DE66544B58B36039FA8506BEAC92F90D6DC2F0C05DF69C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 993d0cec9487ad4faa326ecef7531dd693afea91ad43868b11e9efb3f6f4ca3c
MD5 acd57d2a0c8dd48cd524a806f9b118f7
SHA1 f21f1f50a1397b4a3d5a02a93ecd638a7f140e0e
SHA512 4ccd00d23a1b003e0613543f86ba6f5abf6c550e28efe0e2ee74edbfcff6a7d33318d525e914fc414e61a9e95069f09f1c4564b575b069a18b599fc844bc479e
SSDEEP 192:qlskzsNpeQK8wkRbWbQmiU1T1Rl4VRNuOmYx2j9e22RIqAi2U8:WzsNpeZ8zbgbR6VRNuOPxQ9ep92U8
TLSH
T1AA42093579386C774DE66544B58B37039EA8506BEAC93F90D6DC6F0C05DF69C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9458f2db89c0830f24a0adcbbe12586aa4f37f09f00b8a59a28a1d23d5b41a67
MD5 908698ecb1c2363eb0259cacccd23db8
SHA1 6831f5e0c00edb53a9d23d9bc6cfbf73c1f02b56
SHA512 b92585094eed983d88605f5edb92e4a99bc65a6595657f929b953ba5904ec8a8c7e9a6fe6828cdb99f89665d7abf07894ddfc3215a9cbcbde62903277144a7c3
SSDEEP 192:tONW6JkRtQmiUy3NW+RNuOmYxBh3ORTU6:tONW6UriW+RNuOPxbaU6
TLSH
T10A02D735BD382C7B8EF26E49B58B27175FA4207BF9956B80DAE81F0C01D765C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a8773bfdeadfe6b33900fd5b34f930dfb782f5f093ebe9b6b02ae0a2b149b79b
MD5 3585bced4d015c1457027ceda282d5e8
SHA1 094b7082700c94f48268c08217de581015cfaed1
SHA512 f5f1e313a289b942c92d223fd03cacbde8d18caaa9937686c3b00bbd09ba3614b0cd4a388e6e1cd012f5db850a52edb409ed778a99d3277879a301ef384d4777
SSDEEP 192:TONE6JkR4QmiUyhNm+RNuOmYx2j9eoVcIqAi2U6:TONE6UYim+RNuOPxQ9e/92U6
TLSH
T1E31209367D786C775EE66844B48736075EA9512BEA897F80D6DC2F0C02DFA9C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 e8aa0bddf0bbe7c30b2b8b83c925ad09bdefb7ca1d5911f3133074ea6db4a796
MD5 736334042e4bb49c5f2bc91eb96c9374
SHA1 f110df2dba0bd2ce852dfd9cbbddd130bc629d45
SHA512 9f4c1142d12215651977ae461ff0888ba89227d7094c88cc9723dfda17eda07084b710ad794224a7ade143666a76dcbd7d0f15a9358682d7b396093ff4db3610
SSDEEP 192:qlskzsNrYR/K8wkRbWbQmiU1T1Rl4VRNuOmYx2j9ewHJRIqAi2UA9:WzsNr6C8zbgbR6VRNuOPxQ9ewL92UA9
TLSH
T16E4209357938AC775DE66544B58B36039FA8506BEAC92F90D6DC2F0C05DF69C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d006375c-3499-454c-9174-574d9cc62076.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d006375c-3499-454c-9174-574d9cc62076.tmp
Size 11KB
SHA256 409f45aa2431bbf23fe3289dc012f79c1bda0a3db28bb3869cfa301f7d890755
MD5 d6b6c339a273b783464644b9538778e7
SHA1 33e395f17c9ef552d6ad177ed8162353dfd22473
SHA512 c58c97cb7f65b91f3c8eb0fc2278d4b9ebcf1a2bd2e389b6b24a166e49ed372aa68deb71e7e3988b30f9d907d3942c7eb66e0ad4477da4382207c1715ea35c0a
SSDEEP 192:S2LsNpeQK8wkRbWbQmiU1T1Rl4VRNuOmYx2j9e5SRIqAi2U8:XsNpeZ8zbgbR6VRNuOPxQ9eA92U8
TLSH
T1D63209367D386C774DE66544B58B36139EA8506BEA893F80D6DC6F0C05DF69C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd320a5c-199a-4466-8c99-af8f2d786a7d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cd320a5c-199a-4466-8c99-af8f2d786a7d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3f0d058d61f166bc6dbbcd344ad794e863b1ddbcc4060017b5c71f121827b882
MD5 3c1ac24e49182b89c3449ba463613a6f
SHA1 87e57ffcb20aeacc9558fb27da98813793aca8d5
SHA512 cf25304c9d5a9aadaf0c46f654ec4848db8267b031dc94d02398ce8f52e74e996a4a1af3022cdbec7724f60ce3b2293f1ff365cf7cf094988c8820ef0cc1dd55
TLSH
T1CF412A59ABE91149B3B37F5AABF7B86D447FB8732F06C09E10010D4E0A22B41C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download