hxxps://andreguimaraes[.]com[.]br/

Analysis

user interaction
yes
max time kernel
263s
max time network
262s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://andreguimaraes.com.br/
Sample260916-pr4msabl61

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3060	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340356912983305"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{BA254535-DB51-4E9B-AF20-08FA743E4166}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 5044	2340	msedge.exe	86
PID 2340 wrote to memory of 3060	2340	msedge.exe	87
PID 2340 wrote to memory of 1040	2340	msedge.exe	88
PID 2340 wrote to memory of 1040	2340	msedge.exe	88
PID 2340 wrote to memory of 1040	2340	msedge.exe	88
PID 2340 wrote to memory of 1280	2340	msedge.exe	90
PID 2340 wrote to memory of 1280	2340	msedge.exe	90
PID 2340 wrote to memory of 1248	2340	msedge.exe	91
PID 2340 wrote to memory of 1248	2340	msedge.exe	91
PID 2340 wrote to memory of 1248	2340	msedge.exe	91
PID 2340 wrote to memory of 4400	2340	msedge.exe	92
PID 2340 wrote to memory of 4400	2340	msedge.exe	92
PID 2340 wrote to memory of 4400	2340	msedge.exe	92
PID 2340 wrote to memory of 2304	2340	msedge.exe	93
PID 2340 wrote to memory of 2988	2340	msedge.exe	94
PID 2340 wrote to memory of 2304	2340	msedge.exe	93
PID 2340 wrote to memory of 2304	2340	msedge.exe	93
PID 2340 wrote to memory of 2988	2340	msedge.exe	94
PID 2340 wrote to memory of 2988	2340	msedge.exe	94
PID 2340 wrote to memory of 2768	2340	msedge.exe	100
PID 2340 wrote to memory of 4672	2340	msedge.exe	101
PID 2340 wrote to memory of 2768	2340	msedge.exe	100
PID 2340 wrote to memory of 4672	2340	msedge.exe	101
PID 2340 wrote to memory of 5108	2340	msedge.exe	103
PID 2340 wrote to memory of 4408	2340	msedge.exe	108
PID 2340 wrote to memory of 4408	2340	msedge.exe	108
PID 2340 wrote to memory of 4408	2340	msedge.exe	108
PID 2340 wrote to memory of 3792	2340	msedge.exe	111
PID 2340 wrote to memory of 1624	2340	msedge.exe	112
PID 2340 wrote to memory of 3460	2340	msedge.exe	113
PID 2340 wrote to memory of 4948	2340	msedge.exe	114
PID 2340 wrote to memory of 4948	2340	msedge.exe	114
PID 2340 wrote to memory of 4956	2340	msedge.exe	116
PID 2340 wrote to memory of 3660	2340	msedge.exe	120
PID 2340 wrote to memory of 3660	2340	msedge.exe	120
PID 2340 wrote to memory of 2408	2340	msedge.exe	121
PID 2340 wrote to memory of 2408	2340	msedge.exe	121
PID 2340 wrote to memory of 2844	2340	msedge.exe	122
PID 2340 wrote to memory of 2844	2340	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://andreguimaraes.com.br/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb680cc188,0x7ffb680cc194,0x7ffb680cc1a0
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,11492043277747392577,3203568943764754229,524288 --field-trial-handle=2520,i,11707776579286315886,1868371571366435642,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,14845135212502810234,62855927140124421,262144 --field-trial-handle=2520,i,11707776579286315886,1868371571366435642,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,10419407254492334184,17618391924278964775,524288 --field-trial-handle=2520,i,11707776579286315886,1868371571366435642,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,14480010162580265554,12566994581262944404,2097152 --field-trial-handle=2520,i,11707776579286315886,1868371571366435642,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,1030104946654013017,16447127318571519189,2097152 --field-trial-handle=2520,i,11707776579286315886,1868371571366435642,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,17591275098312438234,18296994691461559435,2097152 --field-trial-handle=2520,i,11707776579286315886,1868371571366435642,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,1114770210955674767,119084893880304271,2097152 --field-trial-handle=2520,i,11707776579286315886,1868371571366435642,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:2
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,14952720429606573548,1484189029179799210,524288 --field-trial-handle=2520,i,11707776579286315886,1868371571366435642,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,1905050686746226320,2165882291619416921,524288 --field-trial-handle=2520,i,11707776579286315886,1868371571366435642,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,13642703840397236609,14344074908666103732,524288 --field-trial-handle=2520,i,11707776579286315886,1868371571366435642,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,13642703840397236609,14344074908666103732,524288 --field-trial-handle=2520,i,11707776579286315886,1868371571366435642,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4408,i,10485034852191109646,15888986553668616682,2097152 --field-trial-handle=2520,i,11707776579286315886,1868371571366435642,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,6808167389912772501,9357543921252354158,524288 --field-trial-handle=2520,i,11707776579286315886,1868371571366435642,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,1886757887711949115,16538959762044450316,524288 --field-trial-handle=2520,i,11707776579286315886,1868371571366435642,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,6095772905584892500,4309099002653796928,524288 --field-trial-handle=2520,i,11707776579286315886,1868371571366435642,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,6615427410780798984,5277556281158277756,524288 --field-trial-handle=2520,i,11707776579286315886,1868371571366435642,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3408,i,2013210533472086384,10782019685087329154,262144 --field-trial-handle=2520,i,11707776579286315886,1868371571366435642,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,16647583774739535749,14963424690681983466,524288 --field-trial-handle=2520,i,11707776579286315886,1868371571366435642,262144 --variations-seed-version --mojo-platform-channel-handle=1296 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,6490911118958028820,2374102827241678895,524288 --field-trial-handle=2520,i,11707776579286315886,1868371571366435642,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,6926531935611198729,17868065611356741743,524288 --field-trial-handle=2520,i,11707776579286315886,1868371571366435642,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:2844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

37957d3e-edcf-4ff9-a7d3-6974f2e41753.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\37957d3e-edcf-4ff9-a7d3-6974f2e41753.tmp
Size 18KB
SHA256 51041beddfcfff001e0f6efb85dfd978d68a3d8ef9587106ed288fa82072e749
MD5 a81aec27c783bb5e57cbcba638973aab
SHA1 da67b7e6cbec8b94ce5c562f4cc498ce9e775d89
SHA512 8b6e6d35b5455f82e738979092d1924cc5c54541455df5b79ebf66725a741a8cbf9dc3dc4b4dfe11415dc7e11eb83ea5c9ed6183755e359b1ae35ae6e6654b5c
SSDEEP 384:iZcIrsNBBoZ98MHX58Ek8TJrXtzra7O6R2Feo5zoY:QrFoyac9a7TROL
TLSH
T18C827D75A878AD3B5DF7D085B4863A03AFF58053D7C96F40D5EC6B2E00DA6A8130AD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98f220c14bd3d385f1dd482d8b868745c75685e4a2573b4336f235cf3bdce6c1
MD5 6ce50f5d79ab86d6489a63e08ead9ec4
SHA1 d52fb22446c08230d0edc8374b1dcaed1af585ea
SHA512 fd66aaada3f82de40a9236f167ecb23bc285a49f72374f567e078118a8bdb229e4fadc26c639553cfacaa7d7ba44e0419f17b4bb4a9a8999b51bdd037a28783a
TLSH
T189D02BF4E69455E4D441283C11130304314CC4001C033010C46141D21D8D7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 02cf6c2debe9573f3713554c359339f3deb6fa4abd8c14fc6d2577e42ce2d830
MD5 eec56aca3717cde66f2f4d578de1d4d9
SHA1 965ee07ac77588f49d8c4fdf547b37349747a74f
SHA512 90d05594a407bba8ca844c3df6d127aec4c8ecb87f3d2106da447965d8445c3863cdc5a376c90818be642f5dbacedbbb845f24cc640f422e049733d24470df99
TLSH
T163D02BF4A6D459E4D841283C11130304314CC4001C037111C46141D20D8E7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5552e2516b13a0d7f0f1181a6084258198d5637554c6dfe98544e711c8f29c31
MD5 47bf72567fbaa3eb01aa324b1b90cb3e
SHA1 f968c1eaf7ac6d48fa52da695c661beaf295e346
SHA512 d0f26e358640ebc4d38f536ee6f546dd632a0604ba50f75fd33e134f111b1cfe80295736f0255356a5230a5dec7c0c0470ff41451252ddd350c8f5d6e9718796
TLSH
T12261D990D3924158F7E5B871D2DCE567B2BC4487ED83DE2AD0F5F6BED90A3816028300
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59765f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59765f.TMP
Size 2KB
SHA256 c38945b06ffe13cf37428e8479441c3069d8e8d8b9bf908f0b18aa87d2a0fc8f
MD5 00fbc74dfd21b44e09a8571cbe3c560f
SHA1 4fbddc0580d11a521046a9bac49400311dcc1848
SHA512 1368934a7bf36c45fa610d7a06f094b353466be45fe2ec6fa307fce7679d4781a1f0a501913ef2a80521d223601b86a37d46de3199dabc5d1b0662acb8d82c15
TLSH
T11D519481D3924598F7E6A470D2ECD1A7B6BC44C3E983DE4AC5F5F6BEEA0A3806024340
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 13c82cbcd624fecf2dd7f80bd61c966f190389c9951793e970063e691d93bc2e
MD5 e09274aa6cf8a4cb81139bc9607950d3
SHA1 0778f23a913ae60a5fff281e03a6c650a46bf4a4
SHA512 284f6010eba864cddcc4f9fdee53bc0c041d04fafd7df833d15938ce822d9aa62f15d071a8e4661355a578e24ca0bd8a706362f51760695b9ea37f08345b6334
TLSH
T1A2816CB792E8E61D891256F09B24EE1ACF1D156183383C9BC5D4AF8BD3E3161E101B7E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 0016a05a7e751d749039256b0de27577e807219bdd1959d716c5a1db8bba00fe
MD5 12f250f320103b85552a687275a7fa1c
SHA1 480f359a6a4ef8d10126c6e880924b62debc314e
SHA512 14212c77d4656a9f99196506755ed9e069d26750f83020cae2bb261beebf24f444b66ffe70cbbc5bd458ccd9f730bbde663dc833f24ea4c03a0dffdef32c7f45
TLSH
T1E6817BB792E9E21D891256F09B24EE1ACF1D156183383C9BC5D4AF8BD3E3161E101B7E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8ae32856a45d14af3e7a5bb6a0988354e71fd1be83f7ddcf46e35a49734ceb39
MD5 0220ff472ac11cb398daf649963e5229
SHA1 50c1c66f68abea2d8b67f3e1448396a4f0e7b555
SHA512 9d86ccc6b124096ad39a4e8d6de9c59343f301712d60b3bc4c29e6e0693e2773e6a8c2045cf2d3f042e632514fb6956c160ed6fc333beb8932da83aa59bfbf0a
SSDEEP 192:sxZjROWD/fQsB8AOpIdpIj/HW6+WNI4oH/YrRMWIg/E8J:sxZjvD/fQsyAOiIjHbIn/88g
TLSH
T12922A7566E38B93B8CCBD219FA55BF53D6F9503291941E84AAFC861C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a9ecebe7f96934cd105c57b8f44ea38a9b59368c953f9d1fb390753d1f21e15c
MD5 b6ff20bda345ce70720914d95e8bfd9e
SHA1 b40800f0a407c6330a349a51ced8da400d88d61f
SHA512 565b44766828d201e19215bdfb4d65fd8edd1d2b2f106127ff06190a1264ee7bac5a46e18a89c99d079e5882bccdeab6f7744cb8e22d8998e0a4440a65b0e72e
SSDEEP 192:sxZiROWD/fQsR4AOpIdpyj/HW6+WNI4uZC9ZYrBq3MWIg5NE8J:sxZivD/fQsKAOiyjHbI0ZFjog
TLSH
T1CB32C7567E38B97B8CCBE259BA15BF53E6F9503291901E44AAFC861C14E7BCD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 bb176f946d6264422c4fa0494a3a0ec79be6cdd5183792403f490776fa87771f
MD5 49a910ba68d34e3f496d38540eaeea18
SHA1 7d21ccd9de3acc6f4dee95712d83fa9cffe8244f
SHA512 d198d0edc00a9324b7f3f6561ec885280614638f9ea37b3d27e57df1c9681004b95ac962415c4a218309c2fab24a1b71aa503082fc801b1f19ec34718643852a
SSDEEP 192:sxZiROWD/fQsR8AOpIdpIj/HW6+WNI4oH/YrRMWIg5XE8J:sxZivD/fQsCAOiIjHbIn/8Sg
TLSH
T17822C8567E38B93B8CCBD219FA55BF53D6F9503291941E84AAFC862C04E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 812f5014700b8aaa3d70abba17c33c535e767a7847858c7ef37ca9ce92355b0f
MD5 0ea54612c2f9f15660bb278ef0a734c6
SHA1 78eb41ccb60fa2113eb65601ae6d20b79cb8cc21
SHA512 1a85f670f465ede2083634ca33198a0c4ca2d8782a736ceb71ccaae9ecf685e88a5154ea5ddcd1d3d009a6dd7c57c4b52af84f6300ab4280d6b3d542d2f9b949
SSDEEP 192:sxZiROWD/fQsR4AOpIdpIj/HW6+WNI4cEXYrjoMWIg5NE8J:sxZivD/fQsKAOiIjHbI0X2qog
TLSH
T15022C8567E28B97B8CCBD219BA15BF53E6F9503291941E44AAFC871C04E7BCD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 abb1da18e97ceb74c1330968903ef4cd72b0471e70f8b1e3d1ce6bde33572a28
MD5 01fc430528533e0416959b3294da5ae0
SHA1 c85b91f1db424df08a36b28ea1af47eb758a0331
SHA512 c8a9e057cb4150c262bac6cdcf41c9b978caed318efe154f82fb609ba88019d4173cc361d07767ccbd99e4f31f3ef5a6d762ca589af8f5892c26391b8759997a
SSDEEP 768:ngy4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbkroRLiW:ngy4J/DWvbtBhu1jajiLm0bvxiW
TLSH
T181C2FA3F684CCA7E4FC00A9DDD5E6F973E9802C79A948D4047FA994C02C77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 509e8504c1096cb09434875d98be2aeffddd113c3d99d9f7b9c6841304ef044f
MD5 2a4ee1113137bf350e2b17cf537cfd05
SHA1 5b92147a86a5cec98e385475f96c7c3d35e75b9f
SHA512 bcb3af44012d0544c8a530ba8a8f8f23c03056cb1847dd4d0ae764d4c850a89fcce56503a4e65659dd9b37ac850a260d1eab6fdbe770f44d74863afb4a5255eb
SSDEEP 48:KIDI1Ks04jyLaFoUaYoZbED0ISMZK9w1qZxCJY7coqyLQ5QIQVQpQzQ3QLQkbQ3s:KIDCKs0+eZeKCMKGn2KY/Eb0fL9Jdoz
TLSH
T1A791EE4472BF020139BD2988D0B5C71B42413677715DEA2B7FBD40A69A6FE082EFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59a3a9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59a3a9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3604b393bd879cceb1c32e0bfe66a218d199ba19b0ba5cea973694b16c40568c
MD5 2ddd2caf40b4bd3347cfce5946276746
SHA1 11c0796bdae97bbb3384fb26bc56a4549bb1e94b
SHA512 33d14b733bbd00d9def5ee2dec8c8f8b09e5020206311352b28cf506f65471a853258d7359eb833d5efffb8183ac5770a47bd5bdcb65801862cc016c66e2a36d
SSDEEP 384:iZcINsNBBoZn8MHX58Ek8TJrXtzra7O6R2Feo5zoY:QNFSyac9a7TROL
TLSH
T17A827D75A878AD3B5DF79085B4863A03AFF58053E7C96F40D5EC6B2E00DA6A8130AD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 75190ad2ed34f61b49046ffa88e2536b4e6111d53c6d197beb1f8b6590f99e09
MD5 063248389b262cfff5e1f104d3a71318
SHA1 1cb8ee9d01d68f5b24468ade8c285182bf34a9f1
SHA512 0d0a781e4d6675ede27cf175b3b30fac676968f8155ec49945de693b6d6edb052322031d16cf3b7d5b2defd0e18d5d331f2b1c29982f52194552f7eeb2201c5b
SSDEEP 192:1ONE6wlDgQmiUy2mW4X58gZ0jzorTJfDlMjU6:1ONE6kggW4X58Ek8TJJuU6
TLSH
T17102E939F9687C7B8EF3AD09B48637139FE5116BE6552F44CAE81B2D00D765C1306923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 9edf7a8ac4b92a569adcd95748edb33a4cffce58cb45a2f90684e8e70029ffdc
MD5 f9a58b8d05be44abbb3ac3341d72da3f
SHA1 16c2d5360c96eb563d427c0c8fb89453a58642ef
SHA512 2f72e11981d877bcbfe2d2af011cbda6b1ca83ba803d084dc2d7d8c206d95f2d4d378896212f629f19a032ece49deaaa0ad200e964379669a35604822d85ea06
SSDEEP 384:ksNBloZW8MHX58Ek8TJrXtea7O6R2Feo5S:khzyacQa7TR3
TLSH
T16D623A35A878AD3B5DE79095B04A3A13AFF58057D7C92F90D6EC5F2D00DE698130AD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 efee468d4ca740c1d1650f7206526247feb7b27c571d7113ffc6b1994755a98a
MD5 3e935b566fde9460bcf2608869f0291e
SHA1 dccc913162310845130cece3b2e814d9ebd62133
SHA512 200c034cb908864c3e4f7d84f09d27b975d6f772b64a0927fe49678cae5493e72054908ab42645304e0de5a69ad682bfc07ca92a98a2af3efda80d316760fba4
SSDEEP 384:liFiZcIDdsNT8TUNTUlIl2oZ9YMHX58Ek8TJrXtcna7O6R2Feo5zoY:sFQRKwgX8yacEa7TROL
TLSH
T14FC22BF258EB993AD9AE9743A77D2D029EBCC053B5855A40B3D85B1DCC861BFC306C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 34e31ac6c9b67cebde5396da03e9d77fb2fcb586484ceb909bd4ec83d7e9f50d
MD5 299f68afa34efe4f46cfd428ee276f9d
SHA1 60b8dbda05384f910d7b1cd23a1002fcfe2342f7
SHA512 2242b513cc5d19c32aa46c44071b8bbabdf845e75af3a99d3f13f44094d626ac69d503ecbeb0ed9c57711838a037fc6fdc862a13178dcf48c5dacac64ac63d74
SSDEEP 384:LZcIrsNB2oZ98MHX58Ek8TJrXtzra7O6R2Feo5zoY:TrQoyac9a7TROL
TLSH
T1A1827D75A878AD3B5DF7E085B4863A03AFF58053D7C92F40D5EC6B2E00DA698130AD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b6939a9888ecc79be3e28cc9de23071c783c86bcf36c2bab663e338482da4e64
MD5 48a29dbba8fcc391b57caa04bdb6c985
SHA1 5e4aa13ad83399a24529cfb2f9c7557d2804371f
SHA512 a9dd39881c57377f79c703666b6453c2c7dd30ea1c135419ad7ae6ad9275c9755d2cedff33a88b2309e71977be1ae74e7731d315ad46df4b71715ad38c3f4bd6
SSDEEP 192:1ONE6wlDVQmiUyamc4X58gZ0jzorTJrXHNsveT/OU6:1ONE6kz2c4X58Ek8TJrXtHaU6
TLSH
T18F12F935F978BC2B5DE3A585B0863513AFA54127EB896F90D6EC1B2C01DE2AC530A913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec1949eb-6faf-44b0-9876-219f03db6f8b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ec1949eb-6faf-44b0-9876-219f03db6f8b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f86963fab683a6b79256901a76592bcfba10ef959b2d962f6015684fb253c395
MD5 8c80c5458549af930e328571365faea5
SHA1 8413e5e0fbf06ae013da61289a4e5cac42fe73e4
SHA512 3afc492c8a396ba2e3095c878f9f84d00aa2caa5ba0c266425df0466a91d1e67fcefdd5d1d81f3f3d7b6d002e7979323332374f029826cab47dbab70db82b760
TLSH
T17E412858B6F9110CB3B3AF1A9BF2A86D447FB8772E4AD45E10110E4F0A26B40C872737
MD5 SHA1 SHA512 TLSH

Submit Download