hxxps://advogado[.]regularizesuplementar[.]com[.]br/auth/RS/primeiro-acesso?codigo=atVzWXHR0MvUWiOyYXb7OpeKOx7MPRYsHsiXUXpmhtRo9908UF&cpf=08883243919

Analysis

user interaction
yes
max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 12:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://advogado.regularizesuplementar.com.br/auth/RS/primeiro-acesso?codigo=atVzWXHR0MvUWiOyYXb7OpeKOx7MPRYsHsiXUXpmhtRo9908UF&cpf=08883243919
Sample261027-n7d7dsdd72

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5936	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{1E630D41-B479-4F78-82BD-2AC8D44F4A16}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 5532 wrote to memory of 4720	5532	msedge.exe	84
PID 5532 wrote to memory of 5936	5532	msedge.exe	86
PID 5532 wrote to memory of 4084	5532	msedge.exe	87
PID 5532 wrote to memory of 4084	5532	msedge.exe	87
PID 5532 wrote to memory of 4084	5532	msedge.exe	87
PID 5532 wrote to memory of 5932	5532	msedge.exe	88
PID 5532 wrote to memory of 5932	5532	msedge.exe	88
PID 5532 wrote to memory of 2816	5532	msedge.exe	89
PID 5532 wrote to memory of 2816	5532	msedge.exe	89
PID 5532 wrote to memory of 6124	5532	msedge.exe	90
PID 5532 wrote to memory of 2816	5532	msedge.exe	89
PID 5532 wrote to memory of 6124	5532	msedge.exe	90
PID 5532 wrote to memory of 6124	5532	msedge.exe	90
PID 5532 wrote to memory of 2472	5532	msedge.exe	97
PID 5532 wrote to memory of 2472	5532	msedge.exe	97
PID 5532 wrote to memory of 5920	5532	msedge.exe	98
PID 5532 wrote to memory of 5920	5532	msedge.exe	98
PID 5532 wrote to memory of 4776	5532	msedge.exe	101
PID 5532 wrote to memory of 5444	5532	msedge.exe	109
PID 5532 wrote to memory of 2820	5532	msedge.exe	110
PID 5532 wrote to memory of 5396	5532	msedge.exe	111
PID 5532 wrote to memory of 4060	5532	msedge.exe	113
PID 5532 wrote to memory of 4060	5532	msedge.exe	113
PID 5532 wrote to memory of 2316	5532	msedge.exe	115
PID 5532 wrote to memory of 2316	5532	msedge.exe	115
PID 5532 wrote to memory of 5088	5532	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://advogado.regularizesuplementar.com.br/auth/RS/primeiro-acesso?codigo=atVzWXHR0MvUWiOyYXb7OpeKOx7MPRYsHsiXUXpmhtRo9908UF&cpf=08883243919
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ffdcc05c188,0x7ffdcc05c194,0x7ffdcc05c1a0
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,5707204746667505318,15264872830391024939,524288 --field-trial-handle=2852,i,6674678053464769259,369387746479058137,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1840,i,8817263822425919500,2031685437841074041,262144 --field-trial-handle=2852,i,6674678053464769259,369387746479058137,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:2
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,1757512296803167431,9563037378490431682,524288 --field-trial-handle=2852,i,6674678053464769259,369387746479058137,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:8
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,3358077071514133457,1180261419804061787,2097152 --field-trial-handle=2852,i,6674678053464769259,369387746479058137,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,6271494627011427607,11541259387535999278,2097152 --field-trial-handle=2852,i,6674678053464769259,369387746479058137,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,1588611079157904388,15389094469948758655,524288 --field-trial-handle=2852,i,6674678053464769259,369387746479058137,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,18142653227293355023,10136675020614192717,524288 --field-trial-handle=2852,i,6674678053464769259,369387746479058137,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,14277635816975966509,13127056350294983806,524288 --field-trial-handle=2852,i,6674678053464769259,369387746479058137,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,14277635816975966509,13127056350294983806,524288 --field-trial-handle=2852,i,6674678053464769259,369387746479058137,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,825995807999263288,3582260793005936231,524288 --field-trial-handle=2852,i,6674678053464769259,369387746479058137,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,15815058208063660813,12378284127234328490,524288 --field-trial-handle=2852,i,6674678053464769259,369387746479058137,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,10034759308564077160,16512316101558853791,524288 --field-trial-handle=2852,i,6674678053464769259,369387746479058137,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,9053144871251919293,6889675680456685901,524288 --field-trial-handle=2852,i,6674678053464769259,369387746479058137,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,406753418720964953,8939077152738156961,524288 --field-trial-handle=2852,i,6674678053464769259,369387746479058137,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5232,i,1978645543682266255,3920273341739423053,262144 --field-trial-handle=2852,i,6674678053464769259,369387746479058137,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0ee1c51d-55df-4612-9592-f2cfe75d4c90.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0ee1c51d-55df-4612-9592-f2cfe75d4c90.tmp
Size 26KB
SHA256 cb177d8f7d62d53fc62c212c1debbe26e27cf36ef279277cdcd17279b6d8e7eb
MD5 585099f5356857938dac582f3dc97656
SHA1 842dc4eb3d4062c7bae6352d574297146eb618e4
SHA512 67e52032d5c81f0e841e6a1629e11cd77e910a92abf352542acffe05d8486b15c5da68817be790680e6b8a51b786044e321cfef238d4ddc50c4bb84c9f68e069
SSDEEP 384:nHgiFzQkUSvk3sNl8TUNTUlI48aKMv7DwzWfLBCW/Cv5wJuOwiUvaTZc5gL/7IzX:bFdk34wgwluEBC2ChIOiUvaTZcTL9
TLSH
T16EC24A32E899DDBBEDEA5FE5A24E3643EEE04263C98C5AD4D5C91C1C00DB19D134BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35251774-694c-4ef5-b69b-29febbd55d62.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\35251774-694c-4ef5-b69b-29febbd55d62.tmp
Size 26KB
SHA256 9112242b553385c69004e19a9560008a2c1e56877f21b69ad9efbf93fca37860
MD5 0c17e861e823763e32ba9114b9e8a1b9
SHA1 f8fc04c9a6a840688d2c87ae36fc22adb66ff9ce
SHA512 97625771e8fd7480ecd210b44ef61a00901119915e9606d041db31cbc0154b9b225adca53e2f2ae88a6228020d19dd1599727fb9dff0384cdcdc0b71b290ff1b
SSDEEP 384:nTgiFzQkUSvk3sNl8TUNTUlI48aKMQ7DwzWfLBCW/Cv5wJuOwiUvaTZc5gL/7IzX:XFdk34wgwquEBC2ChIOiUvaTZcTL9
TLSH
T191C24A32E899DDABEDEA5FE5A24E3643EEE04263C98C5AD4D5C91C1C00DB19D134BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7cd3e58a-3ab7-44d1-a2cc-641dd02f155a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7cd3e58a-3ab7-44d1-a2cc-641dd02f155a.tmp
Size 26KB
SHA256 43a39bf964adf6f73cd398f0451b3e88b7e2ce18247ad07c6f88fec3e98808ba
MD5 95058322d2f3908e507fc0712506fc0a
SHA1 2c39b4676fee1277515743f32ba31293b214f203
SHA512 a3dadfc113a020de3f9fded8cdbf9d0896f5ca2e1d8d86c7f411acfe422a620a6e8712fcb131b109d29aa2a34667494c248ac5562732e8f8fb3593abc05c3002
SSDEEP 384:n4iFiZcI63sNB8TUNTUlIm2aKMOMwwzWfLBCW/Cv5wJuOPiU7O6R2Feo2bgL/7IQ:DFQ63IwgcTPEBC2ChI1iU7TRDsJ
TLSH
T149C24B32E898C9BBECEA5FE9A64A7607DEF04163C98C9AD0D5CC1D1C00DB59D170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8477bb12-73c3-4710-b4de-abf6fb7fb1d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8477bb12-73c3-4710-b4de-abf6fb7fb1d8.tmp
Size 32KB
SHA256 f65894934ded5dbd7931b059d75f2ba746c91e5d94a35b776d64bf49e435d7d9
MD5 7690ba34277a533ac576751a26bcee67
SHA1 a245a2a3d88a86fd5c73b557e36331df90f0b0fb
SHA512 90d7c87dc575af74d195da9b8b57267e901391bb7dd61817f615b076ee047da49079f4e31cb26ae2d6dde03fa2134cea0ec78079667fcf5cdc3a19546bdc712e
SSDEEP 384:nHWiFzQkUSvgt3sNl8TUNTUlI48aKM9tDwzWfLBCW/Cv5wJuOgmUvaTZc5gL/7Ib:dFdI34wgw1uEBC2ChIWmUvaTZcTL9
TLSH
T1E6E2A2F1A8D7C977D9AE4B97A33D2D4299FCC113B9885994B7C81C1CCC861BFD20A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

13b70c69-66a4-4a30-8323-0898588a5cbc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\13b70c69-66a4-4a30-8323-0898588a5cbc.tmp
Size 414B
SHA256 48fbad5fe7e6cdff264c0b6cf40aeb9468a05a1349af49c2cf563b9ce4612a04
MD5 ca2b49b25d70005fc43615e054005a77
SHA1 512baf35676cd8c67e0659a4494e83f185434b09
SHA512 ab6e8da709360c44ba67ad1fe851b1479fce4f3ae972f070636368122316e5d2599a01e5b11315c46ca7df3a16e7609903413637556fe09713a82dcdfedc1a84
TLSH
T156E02BAAC821EC3B08FD5B7A50540746F71223272B41994B3B3D90088FB06374185C6C
MD5 SHA1 SHA512 TLSH

Submit Download

2ef380a4-b656-49cb-8739-e41f5af6e091.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2ef380a4-b656-49cb-8739-e41f5af6e091.tmp
Size 12KB
SHA256 630042aa6245e6bb2caba696727e2523bfe2616d96565b854ce4f1554fcec8cb
MD5 47576cd5a2debf15ef29ea2598e56d79
SHA1 60dd69351d2c147e543ae685eb3383a8a4d340b4
SHA512 0624e21d4c49a855e4ee64f0686e08d566d372efed7ada358917c8df4700d8f30a94932c2cbcad6505fd0d327d66f1697302c35b1dcb77c61d48970f039ea2e3
SSDEEP 192:sxZ8RMkL/f4sDaQZLAf8Fzodp4nHW6+WNO65/Yojg5SpwIgjtV1J:sxZ85L/f4sGOs0OuHbl/mSijtR
TLSH
T1D042C6556D38A93F8CCBD719BA59BF53E3F9503290900E48AAFC8A1C15E7ACD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3c091664-e9f8-4e97-bea7-2bfe9234c231.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3c091664-e9f8-4e97-bea7-2bfe9234c231.tmp
Size 12KB
SHA256 319b610d8629feb26f90e52aedd75331a4152bdd62424d6dbaee31fc23099d92
MD5 7170e9e90a97f7fd4285de14354b83bd
SHA1 39a64645d90379d4a53d6000a4cb8f948b53e715
SHA512 7840df609ebc535bcef4bcd8da52f72281dfe241d59d75456203471a540a016043e35e3f4a25ca84a790d9b618a591b8dc903a35b3e61fecbc9c1f3fbfd256a7
SSDEEP 192:sxZ8RMkL/f4sf1aQZLAf8Fzodp4nHW6+WNO8EXYopg5SpwIg5vtV1J:sxZ85L/f4sfoOs0OuHbuXwSiVtR
TLSH
T14D42C815AD38A93B8CCBD719FA59BF53D3F9503290911E48AAFC8A1C15E7ACD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46b0b4e9-b22e-46b4-b445-10d28f751488.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\46b0b4e9-b22e-46b4-b445-10d28f751488.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

5d4123d6-a19a-4b3f-9b63-8e074d02e2da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5d4123d6-a19a-4b3f-9b63-8e074d02e2da.tmp
Size 12KB
SHA256 d2eb0ff7cb95effaaa099d3998e0b49d7708379bd5056cfea8bfc7f438e8aafd
MD5 2199e428e2361c611a09ca9fc6512294
SHA1 7542e81af0670605595cd9ae258dd1f7c4b98926
SHA512 cbcdde80909698ada915ade419551a5cebd799d3799730f1231fade10b83c393cd570c663874685d913152329d8e711648d4d324623fa11cd0ba205fecb02e16
SSDEEP 192:sxZ8RMkL/f4sfvQZLAf8Fzodp4nHW6+WNO8EXYogg5SpwIg5vtV1J:sxZ85L/f4sfvOs0OuHbuXLSiVtR
TLSH
T14242C855AD38A93B8CCBD719FA59BF53D3F9503290911E48AAFC8A1C15E7ACD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 99a54f6d4dc548b80780925f17c17cbbcf44c8348262368c257a1c42be7a5bb7
MD5 044857ccfa8aab8599e68f82b5a56322
SHA1 25a75d46fd45e538b26fde5d36c5a5408bd26dee
SHA512 900c61ba9e746b0546cc7283e7a3dc4e3725ccd08ffe4eb7032e13c2191037b0903eedd0af3bb5c4b6819e6f05900d5b4f21673ce44e28bdf5d8669e76910300
TLSH
T15AE0209555C4C21F510CA4E7025C734DC782361F92C07A0D3B88C5C57557B546682B58
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 369170fb413ce63c013a76a7e9b2bb59a9f619de2aa9cb48ba340cae95f2cc48
MD5 111a07937686535708c2aca62ec54fa7
SHA1 17378832316c973c54b91c498f10b606dc59e9d7
SHA512 4faeec81854ed0cd27a8f676daf08f00bc231a03499ca5d6f128943aa0849e3b2dc0424dd32372a00943c3ecbaba51342d6d8e41267893dec0d92f2f3f6d7e30
TLSH
T154818389CCA0C097FF5ECC7095D81C87BAEE5D8395C3EF0204AED975AE67390950D19A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 68956b16da98b57173a4c1f27923d68a24b3362ad14ba86af757c29bf82ae906
MD5 dd43deed2c2f45f9e85cf2d02d3e6ef9
SHA1 afed32da76b9ae83fa1a149d09ef30a80dfb008c
SHA512 ff95f26f3963688c966c1fc76bf37e397bfe91ff980158c4d53c2367c919200507b521616ab05aa0d6cc6a9c0be2cc2cfbb9bd0897bf044156e109ddd85e2a60
TLSH
T11461C749CDA0C1A7FF9ECC7099D81C87B6BE4D87A5C3EE52049ED4B4EE67350590C154
MD5 SHA1 SHA512 TLSH

Submit Download

2b813b99-bbbc-4445-98bc-046caa867d2e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\2b813b99-bbbc-4445-98bc-046caa867d2e.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

c5c2503b-7568-4da0-95fe-9612a5f25895.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c5c2503b-7568-4da0-95fe-9612a5f25895.tmp
Size 2KB
SHA256 a687e2d5cbbe770e1d0948a5d70ac30fe8e5a847839c19b25ab0013ec6063756
MD5 c79e11e59af5166040312edb2ec4140b
SHA1 a630d5f08d405e45b82790917ac9b93a545e6374
SHA512 3c7a24502f1beb335e7c5ca2cdbd6535149e6b58f766a1d2cf06053102bdae9820e767fb696c8d3ebfbf66c41899bf3f1948b986ab828c4b2adf3bb2fc879b6c
TLSH
T18941D0F387B5866DDA1196F0AB24BE2BCE5D0514432C3C6988E4AF5B97E3471E100B4F
MD5 SHA1 SHA512 TLSH

Submit Download

c9346425-1c32-4e89-a727-7ef9c40106ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c9346425-1c32-4e89-a727-7ef9c40106ae.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

e6a605e6-ddd3-4613-82f7-9817bc5e8f85.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e6a605e6-ddd3-4613-82f7-9817bc5e8f85.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 a9a4dc2ddc97f34e802d8d409e9e2504b6fda21c87529ae359f350eeca0b52e9
MD5 e33a613250c7fd2a6341bd164b2eecf0
SHA1 416e7911ca9edc43aa2b3fbecf894178f44f277f
SHA512 753a0f41c79a141f17b13b58bd42b6f0b640cda4a4873b6926d45b02edb07988715aeebe36f3ea96f6b0534a043d948d67a8454704897ce40e334da65ae61385
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgh:ST/2dXOJhJlpfnpp3tNXVrN3S9Da
TLSH
T1BCB21F1571BB021039FE391892B5972E168231B33119E66B7FBD44B68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

bb451600-8429-46b8-8c7f-fd67e862d9c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bb451600-8429-46b8-8c7f-fd67e862d9c4.tmp
Size 12KB
SHA256 61bbf0a9ca305e65903c3560965751fdd03c1a0396351b449b4afad232862fd9
MD5 b888e156f45c25b6ff343f271537165e
SHA1 8d1becc585d666a01e16b8df958b2c4278a25fbc
SHA512 13982fed34165e5ac502ef168d4f0873319491e0718e4e642a0c68bab648993bf8e6e87ebb6139be8ee26d8068936b1df22008a815fd2905e4e81828db9b2935
SSDEEP 192:sxZORMkL/f4sfvQZLAf8Fzodp4nHW6+WNOX7dYoLg5SpwIg5vtV1J:sxZO5L/f4sfvOs0OuHb+duSiVtR
TLSH
T10B42C7156D38A93B8CCBD719FA59BF53E3F9503290911E48AAFC8A1C14E7ACD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fab65a68-fdbd-43ff-bcce-80208830afe6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fab65a68-fdbd-43ff-bcce-80208830afe6.tmp
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 57c62ea3e31cef2bb41894b23d9f5961c6755899256034f013fd12bab3ef4737
MD5 08ce15827cae4970b91ac1bb59d9a374
SHA1 136f2081e7aa19bacbc0a80fe6097b6e9475245d
SHA512 e06ec0eb3253b39ff4b9dbe9bb573af5de140d970e1d91cbf5fe9f4fe52f60507f819b200e13fc305e769036e721440731cf08ab3e3bdce58f822e721bb8bc35
MD5 SHA1 SHA512

Submit Download

a7789931-861b-4794-8cc2-5fe6bf4a7724.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a7789931-861b-4794-8cc2-5fe6bf4a7724.tmp
Size 392B
SHA256 50f983ba62d9eb75fb4f929eab226a66f82b280bd1c486c5fcb1a9bf5df4bf6b
MD5 5118be95858afccd99b791d322b093c7
SHA1 8e1909f96f1389db6eb7595e32a512b566082973
SHA512 0e970afbe9b927cff611f0d5e78cfac36d7aa1a606ff6ddbf4bad3d4c281b7bef2bae1f27a3902de14faa72b453284f9fc865415015b75f6bccd63a2afb2e909
MD5 SHA1 SHA512

Submit Download

abee458e-72ff-4164-9e57-4d5ecd1705bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\abee458e-72ff-4164-9e57-4d5ecd1705bd.tmp
Size 25KB
SHA256 5d025046c95d739b8db23f02ea3e0987743df66548a186f8368c25e1e7fc3013
MD5 2f5c41c221add21f79fab8724e53e76c
SHA1 8e7e3a78914aa8689d0067da36027f590610623c
SHA512 43b3384ef46a99362f6eaf789009004e8afcdb77cf59aff88b972e1ecf1b4bf77dccad0223918174ffa0199d604b4b18c7d2546c7d1f782849193b561f785055
SSDEEP 384:nuiFiZcI63sNu8TUNTUlIm2aKMi14wzWfLBCW/Cv5wXFby7O6R2Feo2bgL/7IzwJ:FFQ63rwgcUHEBC2ChqFO7TRDsJ
TLSH
T10CC24A32EC98C9BBE9FB4F9AA74A7607EEF40163D59C8AD4D5D81D1C008759E070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d8892701-2496-40a6-af79-925c669433c3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d8892701-2496-40a6-af79-925c669433c3.tmp
Size 392B
SHA256 2addd9dbdf653af261109bc3370d4e899be3dee630df1d2d8bfa978a3bc19541
MD5 3fb9372e97ade449a175d456209ee59b
SHA1 79aa8f579bde4bf71a2bb8b666ee7ac986c79e8c
SHA512 87e8f9b24ac6ddf2027ffe3d5ded075b9dfc3c17c9fdeb7df414d5edb9298b57bba9134eaf87be6b4aeb296e6b8509bc087f32314991776756ec717958f0f7fb
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 dab6c9776696b855acf8f6ba20cf13a877b47bffcdbd0c3b54132fca7c7dbc13
MD5 b556d824772c2d8236772b888b41e7de
SHA1 09845e5f802cd39c3185d0c3d2b5c8a2a1174da3
SHA512 eee82cdef6cfe6d25c2c433855ceb12a6d4724923e57cba1f573b0ceb41b5fb4f2aa075ceb5bb1db766e1972e29c03fe2b7ad2539e8ba2362b771e29ef560c8d
TLSH
T1BD413B5DBAF90148B3B7AF199BF6A46E447BBD772E06C05D00110E4F0A22B44D9A2B33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4776-249-0x000001B480000000-0x000001B481000000-memory.dmp

Download