hxxp://images[.]google[.]com[.]br/url?q=https%3A%2F%2Fjyrabogados[.]com%2Fdatarelay%2F&sa=D&sntz=1&usg=AOvVaw19r0lFpGotYVkYMqzncRxz#?qZ=test@gmail[.]com

Analysis

user interaction
yes
max time kernel
34s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://images.google.com.br/url?q=https%3A%2F%2Fjyrabogados.com%2Fdatarelay%2F&sa=D&sntz=1&usg=AOvVaw19r0lFpGotYVkYMqzncRxz#[email protected]
Sample260930-g5aymage52

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4776	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{AF644537-47A1-43E4-BB55-A7F36374FABD}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 3796	1160	msedge.exe	87
PID 1160 wrote to memory of 2760	1160	msedge.exe	88
PID 1160 wrote to memory of 4776	1160	msedge.exe	89
PID 1160 wrote to memory of 2760	1160	msedge.exe	88
PID 1160 wrote to memory of 2760	1160	msedge.exe	88
PID 1160 wrote to memory of 836	1160	msedge.exe	90
PID 1160 wrote to memory of 836	1160	msedge.exe	90
PID 1160 wrote to memory of 4932	1160	msedge.exe	92
PID 1160 wrote to memory of 3996	1160	msedge.exe	91
PID 1160 wrote to memory of 4932	1160	msedge.exe	92
PID 1160 wrote to memory of 4932	1160	msedge.exe	92
PID 1160 wrote to memory of 3996	1160	msedge.exe	91
PID 1160 wrote to memory of 3996	1160	msedge.exe	91
PID 1160 wrote to memory of 460	1160	msedge.exe	94
PID 1160 wrote to memory of 460	1160	msedge.exe	94
PID 1160 wrote to memory of 460	1160	msedge.exe	94
PID 1160 wrote to memory of 1212	1160	msedge.exe	95
PID 1160 wrote to memory of 1212	1160	msedge.exe	95
PID 1160 wrote to memory of 1212	1160	msedge.exe	95
PID 1160 wrote to memory of 3928	1160	msedge.exe	98
PID 1160 wrote to memory of 3928	1160	msedge.exe	98
PID 1160 wrote to memory of 3928	1160	msedge.exe	98
PID 1160 wrote to memory of 3056	1160	msedge.exe	99
PID 1160 wrote to memory of 3056	1160	msedge.exe	99
PID 1160 wrote to memory of 3056	1160	msedge.exe	99
PID 1160 wrote to memory of 4980	1160	msedge.exe	102
PID 1160 wrote to memory of 3872	1160	msedge.exe	103
PID 1160 wrote to memory of 4980	1160	msedge.exe	102
PID 1160 wrote to memory of 3872	1160	msedge.exe	103
PID 1160 wrote to memory of 4900	1160	msedge.exe	106
PID 1160 wrote to memory of 4280	1160	msedge.exe	118
PID 1160 wrote to memory of 4280	1160	msedge.exe	118
PID 1160 wrote to memory of 2492	1160	msedge.exe	120
PID 1160 wrote to memory of 4800	1160	msedge.exe	121
PID 1160 wrote to memory of 2412	1160	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://images.google.com.br/url?q=https%3A%2F%2Fjyrabogados.com%2Fdatarelay%2F&sa=D&sntz=1&usg=AOvVaw19r0lFpGotYVkYMqzncRxz#[email protected]
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb81b8c188,0x7ffb81b8c194,0x7ffb81b8c1a0
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,16057156463985547465,15992717131052291517,262144 --field-trial-handle=2168,i,8518266496729259855,6406974104913163720,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,4697383960594317363,7521682316257588981,524288 --field-trial-handle=2168,i,8518266496729259855,6406974104913163720,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,3464404922104704586,1257439797265083779,524288 --field-trial-handle=2168,i,8518266496729259855,6406974104913163720,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,10645568044689449215,7582295402530417892,2097152 --field-trial-handle=2168,i,8518266496729259855,6406974104913163720,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,1169993503188802606,7915099756115202665,2097152 --field-trial-handle=2168,i,8518266496729259855,6406974104913163720,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,5083966621961761923,5309203339644229009,2097152 --field-trial-handle=2168,i,8518266496729259855,6406974104913163720,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,11017572595643045838,17667680553007103676,2097152 --field-trial-handle=2168,i,8518266496729259855,6406974104913163720,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:2
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3636,i,9043452113625947524,16980157871379261577,2097152 --field-trial-handle=2168,i,8518266496729259855,6406974104913163720,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5208,i,13945608240121682006,9581753183088587029,2097152 --field-trial-handle=2168,i,8518266496729259855,6406974104913163720,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,13401914881625438061,9526294583447765843,524288 --field-trial-handle=2168,i,8518266496729259855,6406974104913163720,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,11963981717936388875,16518172435162613016,524288 --field-trial-handle=2168,i,8518266496729259855,6406974104913163720,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:8
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,12320744399168225333,17042977218528780566,524288 --field-trial-handle=2168,i,8518266496729259855,6406974104913163720,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,12320744399168225333,17042977218528780566,524288 --field-trial-handle=2168,i,8518266496729259855,6406974104913163720,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,9365357890013689982,2961039779405574212,524288 --field-trial-handle=2168,i,8518266496729259855,6406974104913163720,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,9596011509842542503,6727594095091376610,524288 --field-trial-handle=2168,i,8518266496729259855,6406974104913163720,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,12299562918332098484,10948979387389228451,524288 --field-trial-handle=2168,i,8518266496729259855,6406974104913163720,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,9439989707178831385,7530442139839179034,524288 --field-trial-handle=2168,i,8518266496729259855,6406974104913163720,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:2412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 bf20e27d8a2e9761992545f36ab6b3d8b1b2f3bcc8b3dc24593b87d764f60426
MD5 d8b12d915024f6ae5bf0c6c6037eed9b
SHA1 d450a52dd7328ac8f707d668b84d96a049ea72cc
SHA512 e0c78be9ac6072cb164daacfec7efb69a9e270c26034fdc61f49c13f451de1ba846f4bdd02a57e4082feca1f452caf82c1ed27d3837e6b8e80895486a961efab
TLSH
T10A51FB91CEED8468FBAC45BFA9C37E873EF04A40395F5FD120E4E3B85B063018100855
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d0b364672d18dceb3e2b0e09bceadc901dd035874d339e63d62b1ef09b828adf
MD5 e93cb5d9ad523cbe4c78901413ae4c93
SHA1 e0220a7fdbca378910bf8863651536e33d4e7418
SHA512 a8cd1cc1cb67f83358b27a72e7dc02d282bc52b4e00ac2e7dde804dbdbe8549f757b7ef15f007552fabdd937607950f6d2c62da4eb6f1280a61d40c79ab8d535
SSDEEP 192:sxZqRDWb/f5s++DIdpdClHW6+WNoypP/YapziBIgrJ:sxZqIb/f5s+ZIHb9/C9
TLSH
T1C622C7526E38697B8CD7D20DBA55BF13E6F95032A0D51E88EAFC861C04E67DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1e848ea33566ae4566895e507ab4d776c0efe3c28618ae554bb87fe55b6162be
MD5 107e148224eadd11d23e3c60ad452847
SHA1 732c875bfffd86fcd2e5883300d4dfb59cb6c87b
SHA512 017693a9d64d75997bc3694d32ba7311dc74edc24aee9db7af0172c3ddda2ea4d6753e64b66f0d4f47c1e3ef08ea3a70f20a7844640dae7e963c30e89cfd0cdf
SSDEEP 192:sxZqRDnb/f5s9t+DIdpdClHW6+WNoypPXic/YapXiBIg5KJ:sxZqRb/f5s9tZIHb93/yc
TLSH
T14D32E8526E7869BB8CDBD20DBA55BF13E6F55032A0D50E8CA6FC861C04E67DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c708b4a6a2baadf1574bbe03ba14d85f998eae7068c8dd03ac7263d26c2c4018
MD5 3c78513ab9e7c59e5934a67af4aaed77
SHA1 e907b67a3bb8967f10dfd01e427435ac6651949b
SHA512 6a50e97b7bcc9deafb016ae1aecbe7fdc4abcc7751795b2bce84cebbca95c275123b083c9a8810a7f9b3d63acd26c1c98b8cd686e7c68f6f5ec11d54b2291f47
SSDEEP 192:sxZqRDWb/f5s9G+DIdpdClHW6+WNoypPXic/YapeiBIg5oJ:sxZqIb/f5s9GZIHb93/lu
TLSH
T14122D8566E78697B8CD7D20DBA55BF13E6F91032A0D51E88AAFC861C04E67DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 9b0a867a9bab6304b38fff7ff5b939dbd761253bc39a81fcf345e86fae6df8d8
MD5 b028f45d03ccf6c7f66ccb7e79cff5e9
SHA1 7f55c372c98c696a99ab779dd011ed010e0dea62
SHA512 08c8f5e30c3ffd6b2d608c6e25ebc8228dc004c860df992c3e355068d78351ea40471c65b1077fe7aedecbade972cf167105f7551e0c76433e99b232ebe15424
SSDEEP 768:MAWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy73ro4VfeZmR6:MAWPcLKWvKeEeu1jaClLiF7k4VWZmR6
TLSH
T148C2EA3F644CCB7E5FC01A9DDC5A6FA76E9802C79A548D4047FE984C02C77EA912A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 164a11c3b6da76ac5f42d19d11ac5b4c4009f230880fa06601f4734178fdbfb2
MD5 2b0e5630762e4516438d7db4e761b871
SHA1 b98dcf1e0239dfc225489545723171472e23f08c
SHA512 7259fdb276ca17ccb2e86a43ee19cedd6a597b7e53dbceff87023d8991e8acfc885fe8b4d5fef2991f7f80b9c2ae1890748cdaad4587a7c6df4cfbd599899d4c
SSDEEP 96:KyFkBFnvvu1/21HluKfbHjuLtluzVvYtMpNv3H213+9HN2KfTHb2LltWr1l6KGsY:5FkBFnvvq/2VlFbHjmtluzVvYtMpNv3Y
TLSH
T13D91E915317B235038BE2A4C90A497AF564231733154EE7B7BFC10A64E6BD998CFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 bd95fbf757c2739579cc9513a276d6e93edd290cf91e93889a9776c25007eefc
MD5 b409c3d8f0964242ac97b16b3ea1e7fa
SHA1 b0229505afd415a3f1c304daf3294fa31b9e9b26
SHA512 c411061ed7ccfcee31afc3824827dbb25ca52af76020e7fdf79d71bab93223ec42ebb9599dbdf6da6ccd026226937343570092cad244ede575b71a1a40b816ea
SSDEEP 384:XZcIhsN93tYv1mE1zIGmS/IIC9iMVZh6DKhHtmod:fhdP51gtiMfYGHtmm
TLSH
T1A7828D729C78AC7A6DF7E545F5863F135EB88163A2C96F90D4DCAB0D00EF2682306D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c035089a0f88e1241052d12f143a09c807831df09beb2402a0e0f38e5d0c81f2
MD5 6375a5d7bb5c670ad451d4b48406402f
SHA1 f63e394d9381d1fe5d526be6e54a5d6518c84fb8
SHA512 edab368271eeae50e905dcf6c4f9faae0eb3f1f3a0a0c5d87f38e9b9e5950e28793c15ee02fd2f9351ca473e2e2ab2f4af22c927e9e4cbbf67f6b45ae645901c
SSDEEP 192:aONe76IE5QmiUyQSTHuIGmSrLIICZ27HLqPU6:aONo6DXwHuIGmS/IICGHMU6
TLSH
T14D120B36AC78BC7B5EE3A945F4873A239DB58227E6897F90D5DC1A0C01EF26C1306D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 56f40ae428d320b0232090678a49e29f789d3d9905139a805f56d17a4ebdbfd5
MD5 1ae79d8ce8823575c744989bdd60d6c6
SHA1 9803a4d894de3ca8297fc0eee8f95102da2d23f1
SHA512 07ab1ab2af63784bc5fcee5864857877d61c9d236e751f736844034747c3c7e18ad11e4276c9d88819681780dc383d8d6e77c6861f1bd14d2a8ddffe5ad67d2b
SSDEEP 96:3qONk2Qsjpfe/tyng7X5ih/cIPURHl8h4otop5JYDSNBnP9ZvEI0IG2jbZ0rLYyT:aONC6IE7QmiUy8STPuIGmSrLRC7sM6U6
TLSH
T1E702F939EC7C7C7B9EF3AD48F4873B236EA5112BA5952F84D9E85B0D00D725C1306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4b3ef66c221a75209838a0a8d53a9855a0b5b7281fb4c3976406b89b9669584a
MD5 d5a002fa1a404c1371b1f86cf3296eaf
SHA1 3c5a16fe0fb01a094d144088881e2ee58f8c6e87
SHA512 842857c49256df90f47c25026ec30a27c48f8d25786931dc5cce3c3ed1d2d8b1d1014c36fbca996ba5bfa0ccf2caa56bfa9ca0b9f22682abb95622def60c93e3
TLSH
T12F413B58B6E91058B3777F5A9BF6646E447FB9372E06D49E00110E4F0672B40D871737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads