hxxps://conta-iugu[.]digital/login/?service=https%3A%2F%2Falia[.]com%2F&ea107fff65b4%7C7864b=ea107fff65b4%7C7864b-89a4-4303-947b-ea107fff65b4%7C7864bc4e-619d-4ad2-9046-ea107ff864bc4e084889

Analysis

user interaction
yes
max time kernel
148s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/08/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://conta-iugu.digital/login/?service=https%3A%2F%2Falia.com%2F&ea107fff65b4%7C7864b=ea107fff65b4%7C7864b-89a4-4303-947b-ea107fff65b4%7C7864bc4e-619d-4ad2-9046-ea107ff864bc4e084889
Sample260826-eepb8asard

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3192	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321899024556208"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2043432456-1617298091-2772621413-1000\{CC844CA3-7DD0-4D24-9CC7-7A73496465B7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3988	msedge.exe
3988	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
688	Process not Found
688	Process not Found
688	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 5484 wrote to memory of 2764	5484	msedge.exe	80
PID 5484 wrote to memory of 3192	5484	msedge.exe	81
PID 5484 wrote to memory of 5324	5484	msedge.exe	83
PID 5484 wrote to memory of 5324	5484	msedge.exe	83
PID 5484 wrote to memory of 3816	5484	msedge.exe	82
PID 5484 wrote to memory of 3816	5484	msedge.exe	82
PID 5484 wrote to memory of 3816	5484	msedge.exe	82
PID 5484 wrote to memory of 5384	5484	msedge.exe	85
PID 5484 wrote to memory of 5384	5484	msedge.exe	85
PID 5484 wrote to memory of 5384	5484	msedge.exe	85
PID 5484 wrote to memory of 5356	5484	msedge.exe	84
PID 5484 wrote to memory of 5356	5484	msedge.exe	84
PID 5484 wrote to memory of 5356	5484	msedge.exe	84
PID 5484 wrote to memory of 4304	5484	msedge.exe	86
PID 5484 wrote to memory of 4288	5484	msedge.exe	87
PID 5484 wrote to memory of 4304	5484	msedge.exe	86
PID 5484 wrote to memory of 4304	5484	msedge.exe	86
PID 5484 wrote to memory of 3512	5484	msedge.exe	88
PID 5484 wrote to memory of 4288	5484	msedge.exe	87
PID 5484 wrote to memory of 4288	5484	msedge.exe	87
PID 5484 wrote to memory of 3512	5484	msedge.exe	88
PID 5484 wrote to memory of 3512	5484	msedge.exe	88
PID 5484 wrote to memory of 2424	5484	msedge.exe	89
PID 5484 wrote to memory of 2424	5484	msedge.exe	89
PID 5484 wrote to memory of 2424	5484	msedge.exe	89
PID 5484 wrote to memory of 2948	5484	msedge.exe	93
PID 5484 wrote to memory of 2948	5484	msedge.exe	93
PID 5484 wrote to memory of 2948	5484	msedge.exe	93
PID 5484 wrote to memory of 5560	5484	msedge.exe	94
PID 5484 wrote to memory of 5560	5484	msedge.exe	94
PID 5484 wrote to memory of 5560	5484	msedge.exe	94
PID 5484 wrote to memory of 5580	5484	msedge.exe	95
PID 5484 wrote to memory of 5580	5484	msedge.exe	95
PID 5484 wrote to memory of 5512	5484	msedge.exe	96
PID 5484 wrote to memory of 5512	5484	msedge.exe	96
PID 5484 wrote to memory of 5180	5484	msedge.exe	97
PID 5484 wrote to memory of 1008	5484	msedge.exe	99
PID 5180 wrote to memory of 4052	5180	msedge.exe	100
PID 5484 wrote to memory of 2284	5484	msedge.exe	101
PID 5484 wrote to memory of 1028	5484	msedge.exe	102
PID 5484 wrote to memory of 3184	5484	msedge.exe	103
PID 5484 wrote to memory of 5496	5484	msedge.exe	104
PID 5484 wrote to memory of 5496	5484	msedge.exe	104
PID 5484 wrote to memory of 5040	5484	msedge.exe	106
PID 5484 wrote to memory of 5040	5484	msedge.exe	106
PID 5484 wrote to memory of 5040	5484	msedge.exe	106
PID 5484 wrote to memory of 5156	5484	msedge.exe	107
PID 5484 wrote to memory of 5156	5484	msedge.exe	107
PID 5484 wrote to memory of 5156	5484	msedge.exe	107
PID 5484 wrote to memory of 2756	5484	msedge.exe	109
PID 5484 wrote to memory of 3988	5484	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://conta-iugu.digital/login/?service=https%3A%2F%2Falia.com%2F&ea107fff65b4%7C7864b=ea107fff65b4%7C7864b-89a4-4303-947b-ea107fff65b4%7C7864bc4e-619d-4ad2-9046-ea107ff864bc4e084889
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x214,0x260,0x7ff84920c188,0x7ff84920c194,0x7ff84920c1a0
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,4762646309617279348,17336098487797856795,524288 --field-trial-handle=2568,i,14076337699225752681,16868269939548450270,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,18401550945413509558,16376444811848705725,262144 --field-trial-handle=2568,i,14076337699225752681,16868269939548450270,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:2
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,3032705804482573419,3214744746300041267,524288 --field-trial-handle=2568,i,14076337699225752681,16868269939548450270,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:13
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,16581321410856619458,5146847929264117314,2097152 --field-trial-handle=2568,i,14076337699225752681,16868269939548450270,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,9882259306225359912,9338156501005970959,2097152 --field-trial-handle=2568,i,14076337699225752681,16868269939548450270,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,18238128090267291392,5868055557885363136,2097152 --field-trial-handle=2568,i,14076337699225752681,16868269939548450270,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,6944816338465233909,1012684467011924828,2097152 --field-trial-handle=2568,i,14076337699225752681,16868269939548450270,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:9
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4212,i,5934846178181389645,7661989027393182993,2097152 --field-trial-handle=2568,i,14076337699225752681,16868269939548450270,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4292,i,841648554802137685,691375670730674308,2097152 --field-trial-handle=2568,i,14076337699225752681,16868269939548450270,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:9
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4224,i,1817922463569945160,11689139772832138683,2097152 --field-trial-handle=2568,i,14076337699225752681,16868269939548450270,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3544,i,15641726137709169543,8627603964335038588,2097152 --field-trial-handle=2568,i,14076337699225752681,16868269939548450270,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,5823938695837186096,10478415040726884465,524288 --field-trial-handle=2568,i,14076337699225752681,16868269939548450270,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,3172704739236060551,13475964833041501098,524288 --field-trial-handle=2568,i,14076337699225752681,16868269939548450270,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,4620615297693266536,14970724145834459209,524288 --field-trial-handle=2568,i,14076337699225752681,16868269939548450270,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5180
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,8680122622068335267,15533525711772952474,524288 --field-trial-handle=2568,i,14076337699225752681,16868269939548450270,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,8680122622068335267,15533525711772952474,524288 --field-trial-handle=2568,i,14076337699225752681,16868269939548450270,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,9962008793942554801,15271921365638957174,524288 --field-trial-handle=2568,i,14076337699225752681,16868269939548450270,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:14
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,16233660695345826898,92785284334273002,524288 --field-trial-handle=2568,i,14076337699225752681,16868269939548450270,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:14
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,14678417625672523644,4638544056785968429,524288 --field-trial-handle=2568,i,14076337699225752681,16868269939548450270,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,15399861332206537867,6965980882883716045,524288 --field-trial-handle=2568,i,14076337699225752681,16868269939548450270,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4504,i,771194284207088641,10439922480546805195,2097152 --field-trial-handle=2568,i,14076337699225752681,16868269939548450270,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5292,i,15612557351763532529,7090271163761199679,2097152 --field-trial-handle=2568,i,14076337699225752681,16868269939548450270,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,7431109239829203633,17583586111511399661,524288 --field-trial-handle=2568,i,14076337699225752681,16868269939548450270,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,7431109239829203633,17583586111511399661,524288 --field-trial-handle=2568,i,14076337699225752681,16868269939548450270,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6596,i,10692078507552700729,15578204352871710738,262144 --field-trial-handle=2568,i,14076337699225752681,16868269939548450270,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3988

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f0ead82c3c8a4cd9959a8cd1cef74705c67e276b4a574243e75c890cb0b0b8fe
MD5 f8a5a8774310485121aa8917052b352c
SHA1 78542cc17bce16f7d0117a4beed6ae29c39c3042
SHA512 94c06ac4086f7321e54c95657a2fc0769092ed3577572d27a9a75f404a57f6b0c02e9bb5c1e8c0c285a577d89a5801c60face4ebf1cee334d6be346c240f09ad
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T1D5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dcfc4c476f41db2d6042449b7b855b9751140e2127be8e8208aafd46a5893b7d
MD5 08e448ed3ad1512fa216c2eea50fff9a
SHA1 2d684e6af180cff0b8adea283dbb0c009102fc3e
SHA512 f9ebe4d980c84e665fbd9643a31fbc7a6b08028d289cd54ea7400acc1d6a7d231dd7952c9c49775207225efebf00cdaaf6a2b295dbeac8f234ed7bdfa52c4693
TLSH
T122D0C073050D0000EA0D41312073C7050313BB210E013C03B855F8381D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 89ab71a3a4e732da8cbbe2e13ba149e13c94226b7119c8a0598106b99907544f
MD5 ca938be236bc251b79a4ee9dbf06dd19
SHA1 2ed95a78846a95a90b8d9b70e9cdc6188f0ce608
SHA512 caf4662a529a373a26b513e285938286f3af46a8729fb4c0be324b084fdba1e10dacca4b8f67585c4a5c6683f45dc7e259548eaf3ffb985905aeefbb7225e0e7
TLSH
T124D0C073050D0000EE0D41312073C7050313BB210E017D03B855F8380D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 dde9a2f6b23b95f2dfbf57f47e0ee15b5304eb4c6a3c3872a5f58de19569dde8
MD5 81c33f6a85a84d757b097d2c3f6f2925
SHA1 1e2d85a803e96a5635fc9c523af30aae6a10ee44
SHA512 4d52519d8985a44dc84990feb10abc6e9f6d538842543af48db1ef161975fd460e900f0f1b26669861ab801046bc54fa9bab3042fd13a2bdec4c28a90ff4f491
TLSH
T1D2710B54D65E4853E7F1D137B0ED31BD3DB3BBAA4C6F4E56009858F4EA063A1C2849CA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 22dffd9d4442af46b8facfb2d7db0ba36eaf6ccde273c91daab2a86ad04f7dfe
MD5 31cdd4950f80922e7ceb8252cc37e15e
SHA1 f270c2e9ab2151898670ac4bb55198cb3d9f160a
SHA512 63d2daa243ed0298e668437ceb26039462f9b9933ea9d162815c338f560836582db0f78c0139fb64cdabb9e0415c6484da3cfd6790a3aa98f4c1d9f46c823846
TLSH
T11B614024C66E0853E3F0D13370DD31BD3DB3BB9A1C2B4F66009858F0D916361C1945D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f4bb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f4bb.TMP
Size 3KB
SHA256 92f5dbd050d53551f486cba3916735bedd721994a6f3216e829e456ae7e46d66
MD5 f43d319c3a221913c56b09b6f727c215
SHA1 dba680e23cb25bc1e600c0bc21b4880a73570425
SHA512 ff01dbf24cb793054f6bf4bc44f769319f81dd64117febc9c776ab7cf1ff3191d8326a6788554c6e287fe7701fdae02258a74128eb6bfd305c1ce86c1a910eab
TLSH
T1B2613E24C65E0893E3F4D13370DD32BD3DB37B9A1C2B4E6600A858F0D916761C1955D9
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 35604485a6adf9a0da2450baed92ed0aa794035e7968ed9618925b3ee1007aa5
MD5 9a4f1962290428fa3ac94acc33997e51
SHA1 7e97c4f2cb082fdeccf2b8d21c05d5c08ef5db8e
SHA512 0aab8fd669e984b782a0503d512fa53120d39b61dfa63d8dd71d8dce9470944e21d3607b952755710dbf981ca3ff85d092d705f4300a5e8c204eb63f9f55f81f
TLSH
T1C261CFF2D3E5865E8A2152F0AB146F6BDE1E0E5843683C5AC9D8FF9B93E1070D10165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 52c0f336868d1d5d2776c3c53ac2696c3fdb97aa4a771df35aa46db0db01b895
MD5 14bce74fd37de82f9831245405b39e0f
SHA1 bd0349980f70410771a77abec87092385525d2bc
SHA512 e822fe5277d263b6eefcea91386ac06e390bcb5da94217eb2f8a04e3dd9fd91b9e100b43ce7e0993d5d3c34513781cbe6086d04cfa5180cafc12c3597dd5eaa4
SSDEEP 192:sxZGRVyM/jK1Ml8MFE/fQsJ4dMIdp8E/W6+WNS4w/Y01quzkgIgrJ:sxZGXdE/fQsJ4VR/b2/5sm9
TLSH
T10152E8116A346A77CCDBD209FA55BF53D6F9547292900E48A9FCDA1C00E6BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 764b76f62b57b3e5ebc33ea8d44d584c97ca9c5f7b285655ae291da0d02d3b4b
MD5 d4f94adf035ce21b4606b720f8094b80
SHA1 65adf25311a5ceac6c6bdb6e9147ae48045a3ff9
SHA512 f65bd9f07494bc081523406bc49c806cfd96e5da1271abd3ccaaccf67dccc6c62043e7fae8ac116ba5e5c1f95b13016c5f95001de18177992ed1db735459ef9a
SSDEEP 192:sxZGRVyM/jK1Ml8UQHFE/fQsendHIdpHKCo/W6+WNXDWr/Wcj/Y01qTUdgIg5LJ:sxZGXqlE/fQsedIQ/bzM1/5s53
TLSH
T17C62FA52A6345A77CCDBD209FA51BF53D6F55472D2900E44AAFCCA1C01E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 ef1d3e15efc78906607c93e72b462671f54b59a6e4b8f32e2bae6164028d2acf
MD5 533703173d7667a239d7f5197e92336a
SHA1 6d6609b03c37370ea7cb2d0c8b2f19b08c5c0d60
SHA512 2271c331c86ed940b3a884ee81c62298ed9aaa291adbfd9756ea180173c6fe09e0669b65db432d99ea52e32011523a4dc73758a950eb23542748a769ec014c48
SSDEEP 768:Do4bSV4b+8b4bm254bRWRmG4b/Qn4bH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3c4y:DPu+68si2y1WRmlzQ4ju1jaKDILpZ8U3
TLSH
T181E23A3B280CCB7E4F844E5CEC26AF966ED802DB66684D4447FE494C03C77EB521A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d394d70ef1fc7498_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\d394d70ef1fc7498_0
Size 191KB
SHA256 5af100a67d45a51152f2c0776099ab662c7e221bb2db38316ea02406b1d5a106
MD5 830ce958627c8b0660f50b9354f6ce12
SHA1 791af0e258a60381722f6911d5739100d9b17465
SHA512 ab1bcd6bd47657584a35d8b7fd188478abd6a07e7e30c3bfeb9b341533d69f5db1eabaa5a894c16c4978bf25e65048d383644a028ed9ccf96ffc17425192e686
SSDEEP 1536:xo/ANGJTtVk4iGmUBDznBChn/jSIClB/wCULnq2W3670mRovNarJUuB6sIncU8XO:CSXUVzB2SICY10HobVIP8XrjvyPP5
TLSH
T138146B715200F47BB913DE60A67E7F4E3C39A16BDD0686FCA5D4E870AAD2DF20521B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 c1c0dc2f647d8ceba842d87daa7bdd60776656cdc8e9cd988b8ac98782c78bcb
MD5 820a68c7db62b753b8a606c5072e3270
SHA1 cfe053daf99a7810c6a73022a195a0f1dec1d906
SHA512 ba9e7c7f774be5993451b3ea1becdc44a65b8288e5e7f34fa7c2ea29a495be0bcd1e331d8d5c906b1a06a80179ba23fd2e25b271db22c4f91ec2b7fb7e6d97f8
TLSH
T157A002F5D7D43C02F850067450C1475473516854D171C65F98D040689D735854907146
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7b6911e056e8896f30e6fc15112ecde1d9e2757c2cee222393d3eb4646b66e46
MD5 6681ef1c1ab38c638cda90521bfd9004
SHA1 0dd7aa4db3fedf4e89bff3e81589837c8a24e693
SHA512 f0268a42683cc9e6a41a69e4ffb32c7deb753d3786057af5a383bb9649c9e0913efc729126dc4acd07f7c7c976670672d260fd1786e00cb43b0e62dc10a3d7fd
SSDEEP 48:KgpItK64QnyhIILKdKcryx6IPKvK87mvYMmoK:KgpCK64yyIgKdKaC6gKvKUmvYMmoK
TLSH
T1B191D69630FE02413C7E650C9778CF665A42BA673124682B7BA802B71D67E105FFC9CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597a28.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597a28.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 70a289a9667e76fb66d18e818ef1d907bb444ecdd3a4cba32fa8ac8df1c2df35
MD5 a1eb2db88bb12a0d225360df4675f3da
SHA1 d35396b6e255bec89b3607702bdfc245c889fa87
SHA512 381fe30156ccbedd61912d5b20b4db9a1103094178720c5c8f856e49031887f594a89ea4e50a2e253e95ee0947b5ed60945216254a5516d71ec36f1854c6bd2f
SSDEEP 384:4ZcIn8Nh4E+U0LZIr3b+AiOAA8CC4+HBbs3Q/od:GnZBsrpiOi54goQ/6
TLSH
T1FC826C725C78ACB75DF69145F98732038FB84067A6C82F80D5ECBB1D099E6AC130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d28080980e77c67703324512bfd6b41a75ab80d6565f1bfb98e1b50fc30561e1
MD5 90182d494b0461b8dc792a82820822a6
SHA1 90e226376e522459489647c5424043df3c1ed807
SHA512 a4d71ae6782d3f9c9bbd264e05d9742ba5cde98016a821fe19e35abe57d26085ed8218914fb7ec239912a0000bc46ab1498617ccf30e5ab49ed51199f720f2c2
SSDEEP 384:/ZcIn8NhjE+U0LZIr3b+AiOAA8CC4+HBbs3Q/od:XnoBsrpiOi54goQ/6
TLSH
T1BB826C725C78AC775DF6D545FA8732039FB84067A6C82F80D5ECBB1D089A6AC130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 5c5bcdad3201b24f380daf076791517529e758aeeab40f4d1aa09b5df29fde76
MD5 7d650e8a09350fa7f17ee02ebee3d88a
SHA1 0f87f07a6644c1ed0022ac7fefe39b5e12e62d9d
SHA512 1301219830941d0c3ecea7047976ba43d151f9b36083a9840d00c34e5467efdfbe0075d464e57b6c1b3d8d9a217487b8bc4a19e20ba31149878a0380010f5435
SSDEEP 384:NiFPZcIUq8Nz8TUNTUlIljE+U0iiIr3b+AiOAA8C94+HBbs3Q/od:EFHROwg/bsrpiOiq4goQ/6
TLSH
T10EC207F248D79877D9AE8747E77E2D034EBCC067B5846A40B3986A1CCC5A1BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 69cf547657837da14f23a954f44c97eb0cc71f6e5704e5e73823160700fab081
MD5 085cc3dda4820e010f37f6f7485a555b
SHA1 9855fc4f89daefcac1aef1fb207d53241dc2ba68
SHA512 ce66e141221816e453101a57f8559c743831c1a40fa427fbf06540144e43b55f8e3f293de5cbcf2c8f1366d77a7779d48844e4a1f576f0f3c27ecd097580b0d7
SSDEEP 384:NiFWZcIUq8Nz8TUNTUlIljE+U0LiIr3b+AiOAA8CP4+HBbs3Q/od:EFEROwg/qsrpiOi64goQ/6
TLSH
T198C207F248D79877D9AE8747E77E2D034EBCC067B5846A40B3886A1CCC5A1BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 30eccc63dba13286876bb649e3b79a9ed5c6b5b92ae866a35ec4c6ae1268bf6d
MD5 e6091bd047de85dd665f4cec572be845
SHA1 e9564a236b9fd3ba2df3d14eb1c9cbaad9c8031f
SHA512 90d8f9dc68a3891c43f1f836dd6744da5894174afb5a6035ad91a4910c82bccebf369482a8c1ec0469b37208f87110cabb6f55ffbde6a903ba5e618900fc70c3
SSDEEP 192:nRGNF6yMQmiUyVJmv1Y3b+jciOAAvMn62U6:RGNF6xCQ1Y3b+AiOAASlU6
TLSH
T13002E835A8786C779FF26E45F98723139FE8113BE5912F84D6E82B1C04C725C234B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d760bb8b958a2ddd26f543a1c45bacef7a1f0a8bf478cee78097de3575fbd3ee
MD5 ad2932fee1f7830ba4a2e03d7fcdcdb7
SHA1 dcbbcb5995bc6d95ab6d12ae749560de49f27aa4
SHA512 a07b41034814528378c56903a4abbd2a0d38120e689725bab057386281bf5448f7ca45ebc3ad823993b4071b55479404ec5525e985accc989f11c62c099ed7c1
SSDEEP 384:sZcIn8NhkE+U0LZIr3b+AiOAA8CC4+HBbs3Q/od:6nZBsrpiOi54goQ/6
TLSH
T162826D725C78AC775DF69545FA8732034FB84067A6C82F80D5DCBB1D089A5AD130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ef1722a02da409fc00fae5b4cef2f45c557f8e6ef503b690e837a238e2c802cd
MD5 11a42600519a0b517b60460b34fb9a4f
SHA1 96c054c0358f450c43c245598fb6b6e452e625fe
SHA512 0c4e030a10afc3336f8a226a1fcbc39f77d3efb327f9ebed83c103cd8328f2e8e84edad33e9c90b49346fa194334c746f1cff5ae69567524e5efb5f052ada50f
SSDEEP 192:sGNM6yMQmiUyx0v4Y3b+jciOAA8CI4MaqgU6:sGNM6tf4Y3b+AiOAA8CQ4U6
TLSH
T12A1209326868AC775EE2A984F98732139FA9016BEA857FC0D1DC3E1C05DF66C130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

199c0b19-d7d3-4d91-83e6-4f8592167e79.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\199c0b19-d7d3-4d91-83e6-4f8592167e79.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download