hxxps://assinatura[.]e-notariado[.]org[.]br/document/key/KNTF38JNGQLVLJAW469G/sign?ticket=CfDJ8I5JXvd6T6hOqrmdy4gI65T9xI0HJECzYEuNxBEb4Qc7jBFsMha89wJe8s3R7_dM-aV5kyWm1Bu4FPpL9nsjNgtX86t1Qk3m8Yule8fAb7PCzwIRlMUy7OA75bHz3v-c61YagOVGIitA8xuYY62dCRCadZo2Cv5iEa1W-35HUqEG5dK5ZCRJZkOyVpnNLN4WBliOcKR4bRP4jKZ5dXSVqPYywYCs91yNY3PUh5rhHnZ63ARb75f_DliSEhPrD_qlB4ztcLRyD1K4jR8j40r4qiIzQYGBSsq5e9p0rishZ1zyZataMTmujcOp0k2iqZVObKLj0cBvz-_g_q6T_D_YO5iayABmHBZB1RJCFiskHzsMEUhSsQX-RhTHK-VD2HbosCU8jC4ZlPW75-jCB4J0Nqo

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 18:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://assinatura.e-notariado.org.br/document/key/KNTF38JNGQLVLJAW469G/sign?ticket=CfDJ8I5JXvd6T6hOqrmdy4gI65T9xI0HJECzYEuNxBEb4Qc7jBFsMha89wJe8s3R7_dM-aV5kyWm1Bu4FPpL9nsjNgtX86t1Qk3m8Yule8fAb7PCzwIRlMUy7OA75bHz3v-c61YagOVGIitA8xuYY62dCRCadZo2Cv5iEa1W-35HUqEG5dK5ZCRJZkOyVpnNLN4WBliOcKR4bRP4jKZ5dXSVqPYywYCs91yNY3PUh5rhHnZ63ARb75f_DliSEhPrD_qlB4ztcLRyD1K4jR8j40r4qiIzQYGBSsq5e9p0rishZ1zyZataMTmujcOp0k2iqZVObKLj0cBvz-_g_q6T_D_YO5iayABmHBZB1RJCFiskHzsMEUhSsQX-RhTHK-VD2HbosCU8jC4ZlPW75-jCB4J0Nqo
Sample260916-w63glacd67

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4696	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340571862124046"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{91665D67-D35B-4B40-BEFF-63136305F726}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 4184	4468	msedge.exe	84
PID 4468 wrote to memory of 4696	4468	msedge.exe	85
PID 4468 wrote to memory of 4604	4468	msedge.exe	86
PID 4468 wrote to memory of 4604	4468	msedge.exe	86
PID 4468 wrote to memory of 4604	4468	msedge.exe	86
PID 4468 wrote to memory of 3760	4468	msedge.exe	87
PID 4468 wrote to memory of 3760	4468	msedge.exe	87
PID 4468 wrote to memory of 4428	4468	msedge.exe	88
PID 4468 wrote to memory of 4428	4468	msedge.exe	88
PID 4468 wrote to memory of 4428	4468	msedge.exe	88
PID 4468 wrote to memory of 4224	4468	msedge.exe	89
PID 4468 wrote to memory of 4224	4468	msedge.exe	89
PID 4468 wrote to memory of 4224	4468	msedge.exe	89
PID 4468 wrote to memory of 4252	4468	msedge.exe	91
PID 4468 wrote to memory of 4252	4468	msedge.exe	91
PID 4468 wrote to memory of 4252	4468	msedge.exe	91
PID 4468 wrote to memory of 4028	4468	msedge.exe	92
PID 4468 wrote to memory of 4028	4468	msedge.exe	92
PID 4468 wrote to memory of 4028	4468	msedge.exe	92
PID 4468 wrote to memory of 2832	4468	msedge.exe	96
PID 4468 wrote to memory of 1596	4468	msedge.exe	97
PID 4468 wrote to memory of 2832	4468	msedge.exe	96
PID 4468 wrote to memory of 1596	4468	msedge.exe	97
PID 4468 wrote to memory of 2364	4468	msedge.exe	99
PID 4468 wrote to memory of 2212	4468	msedge.exe	102
PID 4468 wrote to memory of 2212	4468	msedge.exe	102
PID 4468 wrote to memory of 2212	4468	msedge.exe	102
PID 4468 wrote to memory of 1728	4468	msedge.exe	103
PID 4468 wrote to memory of 1728	4468	msedge.exe	103
PID 4468 wrote to memory of 1728	4468	msedge.exe	103
PID 4468 wrote to memory of 1324	4468	msedge.exe	104
PID 4468 wrote to memory of 1324	4468	msedge.exe	104
PID 4468 wrote to memory of 1324	4468	msedge.exe	104
PID 4468 wrote to memory of 4428	4468	msedge.exe	112
PID 4468 wrote to memory of 1616	4468	msedge.exe	113
PID 4468 wrote to memory of 5008	4468	msedge.exe	114
PID 4468 wrote to memory of 2412	4468	msedge.exe	116
PID 4468 wrote to memory of 2412	4468	msedge.exe	116
PID 4468 wrote to memory of 3936	4468	msedge.exe	120
PID 4468 wrote to memory of 3844	4468	msedge.exe	122
PID 4468 wrote to memory of 1408	4468	msedge.exe	123
PID 4468 wrote to memory of 1408	4468	msedge.exe	123
PID 4468 wrote to memory of 1408	4468	msedge.exe	123
PID 4468 wrote to memory of 4268	4468	msedge.exe	124
PID 4468 wrote to memory of 4268	4468	msedge.exe	124
PID 4468 wrote to memory of 4268	4468	msedge.exe	124
PID 4468 wrote to memory of 3160	4468	msedge.exe	125
PID 4468 wrote to memory of 3160	4468	msedge.exe	125
PID 4468 wrote to memory of 4116	4468	msedge.exe	126
PID 4468 wrote to memory of 4116	4468	msedge.exe	126
PID 4468 wrote to memory of 4116	4468	msedge.exe	126
PID 4468 wrote to memory of 3504	4468	msedge.exe	127
PID 4468 wrote to memory of 3504	4468	msedge.exe	127
PID 4468 wrote to memory of 3504	4468	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://assinatura.e-notariado.org.br/document/key/KNTF38JNGQLVLJAW469G/sign?ticket=CfDJ8I5JXvd6T6hOqrmdy4gI65T9xI0HJECzYEuNxBEb4Qc7jBFsMha89wJe8s3R7_dM-aV5kyWm1Bu4FPpL9nsjNgtX86t1Qk3m8Yule8fAb7PCzwIRlMUy7OA75bHz3v-c61YagOVGIitA8xuYY62dCRCadZo2Cv5iEa1W-35HUqEG5dK5ZCRJZkOyVpnNLN4WBliOcKR4bRP4jKZ5dXSVqPYywYCs91yNY3PUh5rhHnZ63ARb75f_DliSEhPrD_qlB4ztcLRyD1K4jR8j40r4qiIzQYGBSsq5e9p0rishZ1zyZataMTmujcOp0k2iqZVObKLj0cBvz-_g_q6T_D_YO5iayABmHBZB1RJCFiskHzsMEUhSsQX-RhTHK-VD2HbosCU8jC4ZlPW75-jCB4J0Nqo
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a0,0x7fff16cec188,0x7fff16cec194,0x7fff16cec1a0
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2008,i,3093170018546149436,18084349745511502209,524288 --field-trial-handle=2244,i,6912136579629321922,2172852197802461100,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,11025681626373838028,7343002381318422162,262144 --field-trial-handle=2244,i,6912136579629321922,2172852197802461100,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,6297639863164537450,8998205116982480007,524288 --field-trial-handle=2244,i,6912136579629321922,2172852197802461100,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,3596247918956619566,15630665220454832432,2097152 --field-trial-handle=2244,i,6912136579629321922,2172852197802461100,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,17138164021355984637,15914762539445993899,2097152 --field-trial-handle=2244,i,6912136579629321922,2172852197802461100,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,728711554799229505,16916804582614853122,2097152 --field-trial-handle=2244,i,6912136579629321922,2172852197802461100,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,3104334640290435027,6945631786193395034,2097152 --field-trial-handle=2244,i,6912136579629321922,2172852197802461100,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,2949666912086551027,5200880091894707065,524288 --field-trial-handle=2244,i,6912136579629321922,2172852197802461100,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,10640502796332201250,4134400694709626223,524288 --field-trial-handle=2244,i,6912136579629321922,2172852197802461100,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,2461376561501833916,4355654374588190083,524288 --field-trial-handle=2244,i,6912136579629321922,2172852197802461100,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,2461376561501833916,4355654374588190083,524288 --field-trial-handle=2244,i,6912136579629321922,2172852197802461100,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6468,i,2869035446535092814,2796676869704865046,2097152 --field-trial-handle=2244,i,6912136579629321922,2172852197802461100,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6340,i,1828067679941393688,9480757518647840778,2097152 --field-trial-handle=2244,i,6912136579629321922,2172852197802461100,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6748,i,7528042371077620131,11698800531694824229,2097152 --field-trial-handle=2244,i,6912136579629321922,2172852197802461100,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,1634758737852938066,260761676633377458,524288 --field-trial-handle=2244,i,6912136579629321922,2172852197802461100,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,17922342643528616035,6212847901287392217,524288 --field-trial-handle=2244,i,6912136579629321922,2172852197802461100,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3436,i,17730786673588905123,10673814896595246370,524288 --field-trial-handle=2244,i,6912136579629321922,2172852197802461100,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,13850789432579413912,12843545573652495527,524288 --field-trial-handle=2244,i,6912136579629321922,2172852197802461100,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6764,i,9856412810021536810,1013760899450701530,262144 --field-trial-handle=2244,i,6912136579629321922,2172852197802461100,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,11938613969817002627,8243424298136381358,524288 --field-trial-handle=2244,i,6912136579629321922,2172852197802461100,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,11938613969817002627,8243424298136381358,524288 --field-trial-handle=2244,i,6912136579629321922,2172852197802461100,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6396,i,5962122749704859486,14784273433046589057,2097152 --field-trial-handle=2244,i,6912136579629321922,2172852197802461100,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4020,i,1312152084526054999,482202963198014208,2097152 --field-trial-handle=2244,i,6912136579629321922,2172852197802461100,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,10196825746392913311,2632751198083961165,524288 --field-trial-handle=2244,i,6912136579629321922,2172852197802461100,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5652,i,16943990175278321012,4131007849045706175,2097152 --field-trial-handle=2244,i,6912136579629321922,2172852197802461100,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6376,i,8550531171123337199,6476518903648344754,2097152 --field-trial-handle=2244,i,6912136579629321922,2172852197802461100,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:3504

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 6fa1b02b96b249c932f11a4c4f1eb52f042c98bf33d02c325fd422f437c15214
MD5 dab629217416704f76a79a88ad8104e7
SHA1 7976f0ba766ba9c277031e8bb5fb53af02fda376
SHA512 08718b5a2794b585eb95d2cba2f1738b354033d24a471097fdf4f83b9cfe6ba984c2b3c4dae177b4e601dc47eb8b72225f8677ed39d32449fb3f874f22b26d8d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1C1B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d24032e322bda4aa4f943eeee5c1be2eee903b8fa00c6e40c3ae3aab1d6e57
MD5 cf18b86051311e5d4cb3435637b32441
SHA1 81808c10d3ea99d837ac73ca978bbac4af2b14c3
SHA512 d8f6d4f7cc0a9a322acccdf645cd0eaf7d236c68d82f2fd25c2d01e1e6ce323c3d584edd204b1c68ced260f3cf67a5be22a62de64511401735df9213129ac8f0
TLSH
T1EFD02B02FE898A6CD4921C34012E811D36CDF40049027041C0B023974C04701102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ba460c9f5a00478279781ba3317975fb747ea7519f30b24bac67a94df77c22d
MD5 be02dc26a22f37196d8a2ed1f90604b5
SHA1 0d4f49e0f6b152530b0ff133dac678914194c470
SHA512 74fcddf19d34dc2b1dc8ec59c0f57f326e68c7c9b62fb89494b07e2bd52522d6f7662a05f91a2d0787fba43ac2646fc3214bc591a45f14862aa715bcd9206f88
TLSH
T1EBD02B02FEC98E6CD8921C34012D811D36CDF4004902B142C0B023974C05741102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00005e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005e
Size 2.2MB
SHA256 1cd403568d4d2854f4c41d3fa3f22c64df8581943c2f7eb21208a1abe667c2fe
MD5 e0e5eef8898e468b38d3f2d6a078f342
SHA1 95f0dd86dc19b933717a7fa28c8ccf601738ea84
SHA512 7a8729edd492f71d6d76e3e30d6e99370fc85707d22abda11fdf0c00594aee99f0d20bd0d8a285912bbf0a89a729e8ffaae3b9f84967132a5869451f793d363b
SSDEEP 49152:uAZM81bP7gxxlMsrVT3DYg4IFzbbxtQ5itRHT:DM8dDgysKWFzbPLt9
TLSH
T1FCB5338DEF546AC6DB087452E82C3B6B3C1BF97F0BA5CC328981C59C98BD2186671D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4b02f4cecfe2743069a94169a7f902eb9c875e506902ce3004bab41499621ffd
MD5 a3364f634d2e4147d9cc5dade028a054
SHA1 b60c6a6c4eaab70b9396a27fae301c01f8ef8d7f
SHA512 2feeca602d871d3ddaafdf2c4bc78b29ca2585f177185751513cb9749c4180d7eaf45c7e9d1e225dcd1434ae5fc4eb7341db5bd6fe02e63f18cf03ee938e3884
TLSH
T1D2512042ED90827FFFAC6EF18AD4A58B363AE5F819475E3A04E4D6F997463B0490C094
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 412f793729406ffed123f729587a3eec4a5f476736811de6fc3403698b502795
MD5 3d7a895ca7775291d4a7c91c528b105f
SHA1 16677511bf9f5befd233e35507432827a236815f
SHA512 6bbcbb6624bfc3e5c6c798dd693f8cadf792728e9e8a083915ff56d0cab0e9bdf80b918dbebc0d57a1eb5e52e8827173a363120b0d866d51fa4fb990a75db1a9
TLSH
T195614146ED90827FFFAC6EB18AD4A58B363AE5F819471D3A04E4D6F997463B4490C060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591e7b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591e7b.TMP
Size 2KB
SHA256 c5782d79cf299f497c5b02468d4091575daac1080b81f8075289d0fdd51383ea
MD5 05b607eac9d0eae6262f1f72d67a7a2d
SHA1 f24423c0877739294d86f0eaab0889b9757b6a93
SHA512 1ca84d02757db53c1a0fdedefbab4fb72dca87f1d754730643ab4e7cd6049ec82cd419f5f5af81056b2b823874d7a00def345e4c8cdffc4434adc95d65191a1a
TLSH
T19F514242ED5082BBFFAC6EF18EE4A687363AE5F815431D3A04E4D7FA97563B0050C054
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fcc326a84d431b9f064c17d8baab26d15fd632927ca83ac6a687784b3ec6b25d
MD5 f995028ea4b5d850c4be099f7b06ebef
SHA1 af5029fa3ec0fc9203c064bc7587f0c437985a66
SHA512 6d7d0d8895c1f6b0f80d3dd3ed0d37739bbd76b530d87d3a4bbf2c67d630bc98ac609676b8279ffb3c8e1bca01e7268fa9161d105669857335c6a43625f176ec
TLSH
T10451BFF792F9C66D9D1202F06628BE2A9F59166443AC3DD9C6D8DF4B93F30A1C100A0F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 471aed0ba9cea36b56541197cc13fa499f3631f306a7e9d00f7ea78a7b987be9
MD5 974bcb1ecc088afcfb61d1651760d2aa
SHA1 b9adbc21a5b0edcc4251c063ab172c844e52fa7d
SHA512 5286e2b2bfd00509c5d91741e02f7334c3ab06f86ce13836828a0e51a6295600ca2eec0cb0ec2362ccaec563b2f92e47349bd09f99476c87c2d346e31a3d440d
SSDEEP 192:sxZhVRCWT/fasDWw0IdpkTHW6+WNUAm/YYBEVJmIgrJ:sxZhVvT/fasBtOHba/fn9
TLSH
T17C22A5156E28A53B8CC7E20DBB15BF53E6F9543291D51E58EAFCC61C04E6ADE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0276f27d024cc1c054967075eccb081a5f29f198134e30fb2d9446ec8e4c8095
MD5 f6d0e796a2c08a846ebbc6e8d76d36cf
SHA1 63132fd00da81c12a89a6032eb91421a32b37cab
SHA512 b1b613a885ceebd3a0ea69f584655318cde5bd426b353b29f463f19c6d3414602e2ad3aa6521518555947877310f65feeee5feaf377e751423b9c22330fd0e4d
SSDEEP 192:sxZhVRCnT/fasBpwkIdp61HW6+WNUXMZYYBqFVJmIg55J:sxZhVST/fasE9KHbvZfqwJ
TLSH
T1C822C8167E28A97B8CC7E20DBA15BF53E6F9543251D51E48AAFCC71C04E6ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 956142bc204bfeee0058ed24d0d45725bed8951f28349e08b7147c8a25a9a794
MD5 5791c5813080a01f2d9c177b2e9144a0
SHA1 28775d09e92543bb1587516ffef6dbf21c0111d6
SHA512 cabb9e0d956036f4744caceac6480deadac7b351fb5c2da59ba2d5f752443b620785ce07528f0b0e0263bc628ef29d65166fa48176bf81787a5fcf1176f3d3f3
SSDEEP 192:sxZhVRCWT/fasBpwhIdp6nHW6+WNUCpfYYBXFVJmIg55J:sxZhVvT/fasEKsHbvffXwJ
TLSH
T19D22C8167E68697B8CC7E20DBA15BF53E6F9543251D51E48EAFCC61C04E6ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d02da679458b26a239aa1891919b7a42342b0ceed7164cfb42f48420ff190e10
MD5 150240d21701fa5290eb007345a7713b
SHA1 a8b7f8097d1d7bbed4e90dfe1589dd43ac2d8adf
SHA512 e1e43a77a9702b1047613c51f40c7efa919d3f9c282cd20b746575385a32608850a6f477fa7b58bceb752e99e0710edb8ddc29bef4f0bd128b28d04e5e7bb873
SSDEEP 192:sxZhVRCWT/fasBWw0IdpkTHW6+WNUAm/YYBEVJmIg5bJ:sxZhVvT/fasbtOHba/fnX
TLSH
T11322A6157E28A57B8CC7E20DBB15BF53E6F9543291D51E48EAFC861C04E6ACE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2d390f327133cbf7365dcf24524d390ba3f4756887ff6c004181cfb385543635
MD5 547bc635c64d6dcb1ba5a5ed2cf95942
SHA1 cf66bdf84354ca436440274f19e628e8c9720218
SHA512 f444118bc87f14ace6a453f1b8b42ad13e2925b29b72488b84a3279fea6b665e474c1525f4abfb7864ef41bc391a9a0e620ea9494d8acce22410f098a0edec18
SSDEEP 192:sxZhVRCWT/fasBpw0IdpkTHW6+WNUAm/YYBsGVJmIg55J:sxZhVvT/fasEtOHba/fs9J
TLSH
T13022B6167E28697B8CC7E20DBB15BF53E6F9543251D51E48AAFCC61C05E6ACE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 e14f61e4d0db917a79439c093537ba971b913502251221e5a18ca390c2044ef2
MD5 89004cfa55105005a86796bbb321c21b
SHA1 cd853457154461ec4bef1003f68a6c2daa6ebce6
SHA512 48c25db2e1b2f9674dad035c947cec8dfe08b870927b651c8e611c5b14f775783508f578dc98598ce35b60790bf9796639326ad90351ccb4d024ce704ebf2923
SSDEEP 768:mXyYR7jWv3NRB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXgropTZVTqM:mXyYR7jWv3NRBu1ja/CL8OXrPV2M
TLSH
T16FC2EA3B640DCB7E4FC01A9DDC5A6F9B3E9802C796548D4047FA984C02C77EE912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 41c2102941058aa0444dcc4ccfc6a4094e8c49afdd8ab717ba5387d22a59b239
MD5 5c838af89d2e7edb5b2e6a89ce1a328d
SHA1 23e4847e8e16ce8d782c54bae7693143acd5c149
SHA512 0cf20c2dc61376eced5c825dd1d5036cfc5cf45d328703f2cd5070f167e2592330619dcf91727bf6dd2b47111edd67392703c9a8ad0e8b1249bb4a3d18fd9067
SSDEEP 48:KglEZVnTHIbbebIStIK9N1/IxNYYO/VFyLeZ04WcMFbwX4ISQFK901GFx+VYvwsw:KIygK3KmWNKKuIFD6KIAKOhKKKw+
TLSH
T195C1E05431BB064539FE39889474871A528132773066F62BBFBD08A68E6BE0C4DFF4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59906f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59906f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3c3c3a9b6dfbd85968f39d091a83e9f860e5b5d085c4046f79d820d2020b6f5b
MD5 993715c5525332297f59e2b45ffc4bc7
SHA1 38698e0fcecff5c3462b27d3db6e1eec1230f85f
SHA512 c9cf4bc44dc86b3740c4e8161f7af3fdd736a7df0299ff6e1fc03cdb7c6d74d9fc722423a64b448e60e385907580946266ae1b3df596cc44eb65996d586c7cae
SSDEEP 384:vZcIdsN1YD7cZyigvNDQX5+DtQODEBjS67O6R2Feo4h7Uio6:ndXcZyfNEkDeOQRS67TRf7F
TLSH
T1F8827C326CB4AC3719FBA555B44636179FB850A3D6C96E80E5ECAF2D00D9BA8130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 05ba66a3c7ba53e2b01354829aa69470e6daf28f6e6c4dc249709008ffa4351c
MD5 9df40a968c4c8dbd1e4c8baa8223aac6
SHA1 0df19caf650657637eed742b297afe2b30f43632
SHA512 579987da5b1731b1568170ca0fbb2785ea4d812736d233daaa8e42c6fb56462446b4850454974d50ace48e7a315504128403ff7d249e828328e11d3c65da0771
SSDEEP 192:EONT6nnHGQmiUytsOQYcX5hQDP1QOD1Mc0UmU6:EONT6nCzOQNX5+DtQOD1PmU6
TLSH
T18602D934BDA97C7B8AF76D49B48637139FA4213BE5946B80DAE85E1C01D765C230BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 5bea8fd766641535ebccc06897454d88551597138c9732e5b0c9657502b1fd68
MD5 3ef5c0b26a875b01ac2b566528508dfe
SHA1 be345a6e2ac11ccb9b4d92ee9d7aa8a54439c8a0
SHA512 ce7f3394833a79eb2f3d9c22186afb652ccab585ba33a363805f344dc438b739c01160a58851a1e624e0ef17681f01ac5bb23139452e008bc3d39856dbe08fa7
SSDEEP 384:HiFiZcIL7sNP8TUNTUlIlLD7cZyig/NDQX5+DtQODEBNS67O6R2Feo4h7Uio6:CFQniwg1cZyvNEkDeOQ7S67TRf7F
TLSH
T15AC23AF258D79836D9AE5747A77D2D139EBCC063B5849980F3985A1CCC895BFC306C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 74d14e165d79e99db59ce987dc63e3726a0f7441e986b0a0ad0b740f6cf5e217
MD5 a03f00d2df5a1a6ea1a4b55f1385d561
SHA1 c726b95378c94394b3cda9e9151f0fbde1eba476
SHA512 84af01289d5f35dfbccb17a00361dc5786075163ad08b7e5b220902deedfe14169a7e3479662df348a91ca0989bf507aa8fc1abb4b7cfd6653ea8fa18798b427
SSDEEP 384:zZcIdsN1YD7cZyi8vNDQX5+DtQODEBjS67O6R2Feo4h7Uio6:rdXcZynNEkDeOQRS67TRf7F
TLSH
T1F2827D326CB4AC375DFAA155B44636179FB850A3D6C96E80E5ECAF2D00D9AA8130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 500d10402cbe1c6e98d0cda1c3f382a40bbb352b1052701e8bef1b227da7fb35
MD5 966ce9ed6fc63ceec81d3bcddf42af8d
SHA1 00cf71a0852194c414146c13b955bd1c2b2d2435
SHA512 66ca9b08ecc450eb4868bf1cb97fbddbce29a02ea7374e09e8c00dcd8225fbb3182a0ad3552aa29255a8572a8328b1dd386c8b92b60b9fd52fd579846b2fcb82
SSDEEP 384:EZcIdsN1LD7cZyigvNDQX5+DtQODEBjS67O6R2Feo4h7Uio6:idmcZyfNEkDeOQRS67TRf7F
TLSH
T1B5827D326CB4AC371DFBA555B44636179FB850A3D6C96E80E5ECAF2D00D9BA8130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6925b104ef0a2de2aea65c6949db0306be4253914cc76eb271d6e1086b4ad588
MD5 075f72ca6f732d9307c99d7aee28d440
SHA1 fc735ec3542ff22b3a7da60b6742f8ae198d75f3
SHA512 2cec70109e22dbcfd4d9b6aabdbc055544f5a5ee420b8604f39cbd224e1b7853e1fa327ecc944ddd018dc3c6ebe9feeaf6eaf49192a58805dff296d1b9bb4384
SSDEEP 192:EONY6nnHZQmiUyPsORYcX5hQDP1QODEzNKlg3g/56U6:EONY6nXpORNX5+DtQODEBTS6U6
TLSH
T183120935BDA8AC674EE26594B08731179EA51237D6897FC0D6EC6E2C01DE6AC230BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 082a074754e1ee822abb8399a9c513e1e79ab046d468d6c63de42df964958e15
MD5 434ce03a95beccb6d34d32f62c3c7cee
SHA1 fb4884819b49e48fdb63317f2b3f958c2b99929b
SHA512 fc8c7c5be96dbc1a44fe9de246e5dabaa6eae21fd08d2bd0c1757c171c78fea02f3a1cb8a38bc7d943010fbf7468f1f4a00856037f117292498439113a5edf11
TLSH
T144411699B6EA0148B3766E5AAFF2A57D447FB8372F06D45E00120E4F4B22B40C962737
MD5 SHA1 SHA512 TLSH

Submit Download