hxxp://r[.]smartbrief[.]com/a2?case=UP

Analysis

max time kernel
899s
max time network
731s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://r.smartbrief.com/a2?case=UP
Sample260522-plhs5aaz4l

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4880	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239263308248402"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{4F099142-9779-42A4-8297-D1CE4F246F26}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
368	msedge.exe
368	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 3752	4740	msedge.exe	85
PID 4740 wrote to memory of 4880	4740	msedge.exe	86
PID 4740 wrote to memory of 1656	4740	msedge.exe	87
PID 4740 wrote to memory of 1656	4740	msedge.exe	87
PID 4740 wrote to memory of 1656	4740	msedge.exe	87
PID 4740 wrote to memory of 3028	4740	msedge.exe	88
PID 4740 wrote to memory of 3028	4740	msedge.exe	88
PID 4740 wrote to memory of 4852	4740	msedge.exe	89
PID 4740 wrote to memory of 3360	4740	msedge.exe	90
PID 4740 wrote to memory of 4852	4740	msedge.exe	89
PID 4740 wrote to memory of 4852	4740	msedge.exe	89
PID 4740 wrote to memory of 3360	4740	msedge.exe	90
PID 4740 wrote to memory of 3360	4740	msedge.exe	90
PID 4740 wrote to memory of 3032	4740	msedge.exe	92
PID 4740 wrote to memory of 3032	4740	msedge.exe	92
PID 4740 wrote to memory of 3032	4740	msedge.exe	92
PID 4740 wrote to memory of 3320	4740	msedge.exe	93
PID 4740 wrote to memory of 3320	4740	msedge.exe	93
PID 4740 wrote to memory of 3320	4740	msedge.exe	93
PID 4740 wrote to memory of 4580	4740	msedge.exe	96
PID 4740 wrote to memory of 4580	4740	msedge.exe	96
PID 4740 wrote to memory of 3296	4740	msedge.exe	97
PID 4740 wrote to memory of 3296	4740	msedge.exe	97
PID 4740 wrote to memory of 4116	4740	msedge.exe	99
PID 4740 wrote to memory of 4116	4740	msedge.exe	99
PID 4740 wrote to memory of 4116	4740	msedge.exe	99
PID 4740 wrote to memory of 2188	4740	msedge.exe	101
PID 4740 wrote to memory of 3180	4740	msedge.exe	102
PID 4740 wrote to memory of 2188	4740	msedge.exe	101
PID 4740 wrote to memory of 3180	4740	msedge.exe	102
PID 4740 wrote to memory of 2052	4740	msedge.exe	104
PID 4740 wrote to memory of 3476	4740	msedge.exe	105
PID 4740 wrote to memory of 3476	4740	msedge.exe	105
PID 4740 wrote to memory of 880	4740	msedge.exe	106
PID 4740 wrote to memory of 880	4740	msedge.exe	106
PID 4740 wrote to memory of 880	4740	msedge.exe	106
PID 4740 wrote to memory of 5084	4740	msedge.exe	107
PID 4740 wrote to memory of 5084	4740	msedge.exe	107
PID 4740 wrote to memory of 2972	4740	msedge.exe	108
PID 4740 wrote to memory of 2972	4740	msedge.exe	108
PID 4740 wrote to memory of 568	4740	msedge.exe	109
PID 4740 wrote to memory of 568	4740	msedge.exe	109
PID 4740 wrote to memory of 920	4740	msedge.exe	110
PID 4740 wrote to memory of 920	4740	msedge.exe	110
PID 4740 wrote to memory of 996	4740	msedge.exe	130
PID 4740 wrote to memory of 932	4740	msedge.exe	131
PID 4740 wrote to memory of 4568	4740	msedge.exe	132
PID 4740 wrote to memory of 4196	4740	msedge.exe	135
PID 4740 wrote to memory of 4196	4740	msedge.exe	135
PID 4740 wrote to memory of 368	4740	msedge.exe	140
PID 4740 wrote to memory of 4216	4740	msedge.exe	141
PID 4740 wrote to memory of 4216	4740	msedge.exe	141
PID 4740 wrote to memory of 5008	4740	msedge.exe	142
PID 4740 wrote to memory of 5008	4740	msedge.exe	142
PID 4740 wrote to memory of 1064	4740	msedge.exe	143
PID 4740 wrote to memory of 1064	4740	msedge.exe	143
PID 4740 wrote to memory of 1484	4740	msedge.exe	144
PID 4740 wrote to memory of 1484	4740	msedge.exe	144
PID 4740 wrote to memory of 3324	4740	msedge.exe	145
PID 4740 wrote to memory of 3324	4740	msedge.exe	145
PID 4740 wrote to memory of 3256	4740	msedge.exe	154
PID 4740 wrote to memory of 3256	4740	msedge.exe	154

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://r.smartbrief.com/a2?case=UP
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffc2c38c188,0x7ffc2c38c194,0x7ffc2c38c1a0
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,266872424285798985,487612393198056278,524288 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1780,i,18403282040207874474,10307990578653449074,262144 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,6883787436801340613,9920866274992289559,524288 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,13933189732930996091,2151318759486527827,2097152 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,10470605450570960034,11867649651291141219,2097152 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,16624502328666435420,5790341187253040086,2097152 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,16687708190135553141,8122135052886770467,2097152 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:2
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,11521318913452209996,14721157335634969590,524288 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,17543242113218155131,9571030201926949602,524288 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5060,i,1774281778900290710,5256208563515553557,2097152 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,4542994926296790116,3303780533590164252,524288 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,3587189494244772274,13089647588683680934,524288 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,11988174309616825257,8006901551834580611,524288 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,11988174309616825257,8006901551834580611,524288 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,401338971022734854,2302177667058248931,524288 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6272,i,2761633426395759799,576209097758156941,2097152 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,16616587257048183528,11109994528787529426,524288 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,11294152535818889889,281551033940761749,524288 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,5584058481037763200,15475638637887451873,524288 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,3233773497244796152,4303890108631855596,524288 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4604,i,16078272079523380036,16905892174643972335,524288 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:8
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,9030141745196255249,15515256445369590076,524288 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4592,i,5867785413042270078,17888937057489426955,524288 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,598950328219488230,17933659450752825303,524288 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5764,i,4012429048734925236,5699693332648166556,262144 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=1052 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,13685680139382938282,2477412000236997038,524288 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3088,i,17143696568948614528,16007206956931659591,524288 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2972,i,9223916185826730493,9870408363804972408,524288 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4028,i,14130832520134275967,7718531413931683532,524288 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,9823887172873713043,16146688540769357080,524288 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,9279462840776514277,5508441466748654448,524288 --field-trial-handle=2268,i,11098984522487991370,17122321124591094782,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
  2⤵
  PID:3256

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 4970154c03e71372a250182be039e454337be64d232075875a85fe45679e9791
MD5 f5c5af3b32bf2f99864931d9fb64fb42
SHA1 f24e357193c4d16a3e2dd7ccb217f49678a9ab6f
SHA512 e13cff7f429aabbf53f978beb247cb48c5b6dc77f3bd5cc5401dd0008d1b0788c163e99967285b341713f8d21e369c5402e6a1776cbc28df24efbcdd678eba70
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T11EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 6e1e59c7ed7d4042f43bb86f22ed5e13901c61f8b168c70dbe046ff16e798873
MD5 bbf7c772bd840d4127218c1ef3e32ec5
SHA1 f7d6d30b7115e1bdb55d76271366356471ef6b9b
SHA512 7fc7c3ec32e050265cf8efa3bfe8f58a0b6783073ee063e6b15fbabcb58f31c55417ca9dd331f524af3e1480936490b509d509dc63f446a7501287a7b206cd4e
TLSH
T13BE020D969CDC25FAA00748F836CD34CC1D03A0AA3C4794D5710C8D838410506287E50
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 438f3bb68ffdaaf56a8495667de20a84cce925988f8bee83ad0236bb7e2637fd
MD5 c61c59af05256e26290fa361649c4e29
SHA1 c4ec6a42c031b9e95c0194d66910137a25369390
SHA512 77363eb556ed63399f1bf2cc88c43bdead66471aba0830947b3632dc2c645f07ece2a1b008c5a05c350c058481e2b1b2a3f286791646221f51add7e79141bf47
TLSH
T1A7E086D945DDC2BED654A4CB8378A30DC6E07F0F97C86A8E2704D4D4B282944A7D77A8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 ac9a0d4087cc03293092c572c410aaa4d06ac1bedf21745ad4f60b5d587a23e3
MD5 f172984dc349f8c5d449465106634cc1
SHA1 5b3bc9a0ebeb516b08eac1758412b467d414ddb9
SHA512 88b50a5e8920a8af7f8c697707c7f9dba082b4798ebdf8e8efa1ffe6672fb8060f7593b3ba026c7c805cb5b30a30142b09efd9c32b9a79b0977185d354d68f54
TLSH
T15EE026B924CCC3AF9A04ADCF8368930CC3D0361E93C8AD4E1B04C4C4B081154A6B76D0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 c475282b462f1ace3b71cfc03111510a5f5c38e5507667b2e340b35c8c8b6153
MD5 663dd7c91fc587488b292befe9ac8f18
SHA1 18513b5d360e7c130d15e63760350e7ee3becaf7
SHA512 e7d78d91b032af0330ab76b1dcb3d6e2fa496457e35d007d47b1d4d8935ce8b56ba307183a403bf7653080273b1517d5f4d1263fd0b138f784ffbfbeef8e5366
TLSH
T140515CC1022040D8FF500A72D5ED837733B8B9BEB40F6F0E8CE262B29A50321852D87E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c5c9fa60506b570d74e403aae38f1c23d3bb8407ce08eb9f521e09ba05d75294
MD5 3ae9fa2bb87a45b5e4a78479a5039555
SHA1 1f521f24a3ae609cd2f9e0d9ed546700ab977964
SHA512 c75b02c35bd21d75473be5abf6160349ec3aeda1e11936d13bb1c83a5813fa4abfe7d35a524127746b37435e765a54e5b3a2e9397ebf495420426f7c2061ca7b
TLSH
T1CA61AFF783F4866ECA1251F0AB146D1BCF6D0524536C3DA689E4FE5BA3E20B2E14164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 569f51871ee071c05eabf16dbf80a396f725f43fcc126f1a2653481b340371ca
MD5 a7ca8ebec9a3a8cca649a7c1f23050ce
SHA1 244735770abd3b934cdbc28ebc740616a2cf2083
SHA512 9b791793ba5595c74036abc7c2595d04cd30b641c41b321877a5adf0b09679cb9210c11352080373ab1f7ef017149cb38663cc05b511f008564e587e446023b1
TLSH
T1426180F743F4866ECA1291F0AB146D1BCF6D0524536C7DA689E0FE57A3E20B2E141A4B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c7b805c88b52419db16897563b43ac60b2c5452e8c8e2d1be80cb26b5b9c907a
MD5 4a8b815ebc88318c865c36b22e81416b
SHA1 5c5eba3dc7e4dd80a69053534506d026c61525ad
SHA512 c4cad75d1b14a944587493b6c4acb534d4b7f546e57527dd3c50afad51a2b16c18533d4efb0f0e76f7f953f225e587299627a5ad0a0cba108c4c715b33401c28
TLSH
T101719CF3C3E8862EC91256F0AB246D17CF6D0A24536C3D66C9E4EF5B63E24B2E10154E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5175ac0bd404d01a6358bd7d14897ab2f9e4c07566855188288dc6f634b71e29
MD5 7c67ed60c5e958e51e72d817b44007c8
SHA1 127d97112fab3a8df067a0346b65ee0defaa1c20
SHA512 a7e76612b5cb9b6b0c5955f9c8a265311e7acc977752693a79abefe8f10508ca29cd2b7516580e2e381815106b3f48ffe33b1733370ab9438992472c726563c8
SSDEEP 192:sxZ8R2yM/jK1Ml8Mkf/f+s6+AxSTVJIdpfzHW6+WNDWU/egtbfvQujukIg4J:sxZ88Mf/f+s6+AvbHbh/eDQDc
TLSH
T16B52D816AA38597BCCDBD209FA41BF53D6F50572D2941E44AAFCCA0C04E6AED6203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 29KB
SHA256 5ea6acb553862fecae08e107abc7cde2c23b445a497ebe0e832a7efd60dd5fd2
MD5 1087a9a267ff1bd2aadbff7bd329555a
SHA1 ddc8ccede11565f5d084aa8dc0271bf9ecfd3392
SHA512 4432d91e9a6db58ec58116aaf13e83cd4e0550f646487b6363cb5ebd7b6b2a6ce83986933cc61dca8cc94392fe95edd1006484970be16e139c70a049c134231a
SSDEEP 384:sxZ8Tqmf/f+sA+766s8qMpRiYnazAW8pZS15posJWeT+PvpHbh/e8R5:sEumf/fi+74Mnc7WeT+PRHbVe8j
TLSH
T13CD2F906A924C8778FC39D19B47D7E33DAEC40625284CEDA5AECCA0C019D5FDAB47867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f1539a396a0805821c0ea9ba9c4294ccaef82420f61d8323fa7d3640813c1056
MD5 95400aad66f54bd4930071eba1ec804e
SHA1 57a5d56e697f0fad8830d42548898ba0f47c33c8
SHA512 824e49813129b76ce89618f772d53682631b144f053dbaddec0d91d093856cb7355de4f192d9b35265b20376f1a7e1f3b1fbfea0532527579c4d1b3083bbbdd2
SSDEEP 192:sxZ8R2yM/jK1Ml8UQNkf/f+sA+7xSTVJIdpRzHW6+WNDWU/egtbfv0jukIg5NJ:sxZ88qmf/f+sA+7vpHbh/eND5
TLSH
T1C362C616AA385977CCDBD21AFA41BF53D7F5057292940E44AAFCCA0C00E6AED6213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 8225d38b3b9c9bc7b100c9e52aee5bf87e6ce0d48a9e609424d6755c8aef5b73
MD5 abc8982b95913cff77b1138c612e48de
SHA1 e5e5ac82ef9c3e0d554ec26b9770d47cd702d427
SHA512 c07d546aa3ee4e4ded7bc5f74340a8450f96ecf496840dc601e49c98e1c91c416b9e8ef5494181300462853a50bcac0ccc66a618ac043af338d2697c5ba56bbe
SSDEEP 768:NBseJdE7pLuLXhxWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA6VcLly0ppirov:NBseJdIEXhxWvhfynu1jaF6VcL88p5v
TLSH
T18EF2FB3B680CCB7E4F844E9CED2A7F9A6EE801CB56D8895487F9840C02C76EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 408B
SHA256 4e4acab8b6d47bb995c70a32940272eab0186dddf811981e41d00d862055fc06
MD5 5b2628e47c7cb2fba6e7bc18b3c59146
SHA1 759805c6606599afd0becb5486e6bd88207fee94
SHA512 f56c7a9ecfea2d6a94ca95e21b1f541b21ecd99ae6af7285d1dca0c38728abba19e8c4a6dada0215aae0a3ec6cdfae758249ebfd5d0468f1dd83e810d267a978
TLSH
T101E07D144E811466DA244E7220B311E4B3B08CFC3250984B146C5CAE2C2B38C9436298
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c9b6d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5c9b6d.TMP
Size 408B
SHA256 e6c2fef2e79326efbbcc35031231aec16d623b94ba7f7b0627951b7680643a56
MD5 2b75c29722c59b344430624575c1b880
SHA1 e78af3f19b588c29f6a6a9d3eda338fb3e7e92fa
SHA512 63cc91865596e1c9da29e962c3c31d0bc85f4c9caa0c396aaf8989ecb546c390c24d3f3582b05d569daaef0a578e8455e3c0659ffc6bd6699cf8965423bdb825
TLSH
T158E0E74487815461D9310DB7149255FAF370CC603120BC85306D142E1C3A38895611CD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 ca3129bf413065bb51dd6d511b2535359796c53de4ec6def00506586521feba1
MD5 12b51c9f21ac163b459d7dd21c6fbd7e
SHA1 a15bb68f7ac96fb6a0f5006ee4ec7a22b0da3550
SHA512 dcd69be86b6ad7a8a353b1aca839a381f591f17e1214d72644f54ae5bf9cb6096ed1aca53793db95121650726013ffebedfa3309840eb7ea55d1347a4ebcd3f9
TLSH
T11DE06FB62DD32814BEABC3D260308090060A78AAE941BC4EA42BFA9310B2315309BC26
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 3f49c9c522c9f79b9255737260991ef403f65711c9ca395534c27c997033d9e5
MD5 b2d434ed52ec2d82b7440fb30fdb5f1d
SHA1 2fdf2283b80863d98870771e174717fa7fdf66dd
SHA512 eb9c00d6f0bca3530f6a013a7d274081aa8e5ce905383a1c7b3e091b4fd180b2d7f0711355ed451989961ec88896155784ed0a9d88ca28e62274f962807c7e86
SSDEEP 96:KYH+Kggm2lyKuUaGlyKWQx0gKNuO6sQKF+p:49ZtFV3rO
TLSH
T1A4E1451A343A07123C7D298CB3A695360F4135A77058A4AF7FB820954E2FE162DFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e329bc0-8362-4761-82eb-f815c0b18f47.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2e329bc0-8362-4761-82eb-f815c0b18f47.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 78d6405dcc93daaec305cb7637392ba1d456d579e6ce2300498af7f535ca3045
MD5 dd1190c19fbdb460985babc7d86dcc2f
SHA1 6e2aebf3afda030b3146602d0e3620975dd2492f
SHA512 76d9cf851c0341fca8b245cb499cae3a61c72b1520fe1a24b572155ea3dd9b4995d764894dc568be34acdf829ea0bf48a3061c7585e75eb43cf80ea7e81444f6
SSDEEP 384:nCiF1tNnNnb9ZYsNK8TUNTUlIl/MMr70e9s5afghFedLxAcm1:JF1jZbYbwgqMFGhFekcm1
TLSH
T11CC293F298E79577E96E9783A33E7E425EBCC167B4801984BBC95A0CCC471BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b5ff7ee6d4cd62ea7d5c5e3e677e659fd7ca5daaeef59fcfe6581b7c085f3197
MD5 376bb027d7a8bff1b82d8159a2794c24
SHA1 10b085163995ef416685ca59108034bc68142bb1
SHA512 e51a722bb75ffc5fa3c9380ec09cdf32851a184324aa00f9303858b619b71f85e277372ef8d9a6052eb3e708f2eea014762d6c9ca19ee52799b1bbf43e839a6a
SSDEEP 192:lONQ6vMtPQmiUy6/ThTlr+FdLPxuaU847KxU/u:lONQ6UtRxT4dLxIuU/u
TLSH
T113020835AC786C7BEA63AE46F48A37171FE4616FA6D01B54EAE82F1C00D764C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 26583561c98150547e5b885506b6e25e70c70752659565ab60774b8f7b28542a
MD5 29a6515e212d6f87922fb8a4f3f64491
SHA1 02c39bdff16391b0b66d625bcc132ba5be22529f
SHA512 c7861b689045b491892c19b721ce891a4bf8931a00007694c1fcd970f5333171cdf2a3adcfec56f7d040e3e7a28e347a3e9b3e4c585ac1504ff3db931427698c
SSDEEP 192:uuhTSNWMsnMwy8Hrnb91fsNyuQipSM2M7sZtQmiU1TMD4MTlr+FdLPxuauQdM8zz:n1tNnNnb9tsNyuMMr70rOsLdLxhcm1
TLSH
T14C624B32AD386E7799B3AA56F14B37131FF451AB95C02E94EEED5F0D00CB25C130692A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 217c5c88c73f409d1d43bca34cb8e876bc29ffe8e218edc8376aefacd00b344f
MD5 cf44ab65aff12b74b4e0893c8914d507
SHA1 283b0be506dac8d6dcedbfea64792dfd9191c0de
SHA512 3838f2a34fa552d6b42598ae16a594b0704a6d2f03c5275832c841e109d1d5ee10126926c26fb96d5d449aac3adf82c14ad28331cc042713c678594562a8a2ec
SSDEEP 192:lOND6vMzPQmiUyq/8hTlr+FdLPxuauQd780Io/FU/u:lOND6UzRn84dLxgcU/u
TLSH
T16B120831AC786C6BAA63AD46F08A37171FE4517BEAC05B54FEE92F1C00CB65C1306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 ff88b425206c1cce8272e16c663fb3f8b7cdee130e0ba1a178b2dff433dc4dab
MD5 3370615c8d3b793f0d1352abdd568d4e
SHA1 4ecca5ac95f6fb4ac1f20f687b350edd466dabd8
SHA512 0fce687f21b03691f4d1e719afb364ce958ee81fbdcb34fb39fd4ec03c0af250aaa7862a28a3b39b7c97bde8b90cd91e7bcfeee2713502cd0a8bebccefee623f
SSDEEP 192:uu8TSNWMsnMwy8Hrnb91fsNy/QipSM2M7sZiQmiU1TMD4MTlr+FdLPxuauQdM8zz:nqtNnNnb9tsNy/MMr70eOsLdLxhcm1
TLSH
T11A624B32AC386E7799B3AA56F14B37131FF451AB95C02E94EAED5F0D00C765C130692A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 86b84728a2e721ffaf9153d3ccd14e6ddc562489a67d954947702646a1009504
MD5 442e7b479f5cfea0d8c6cc085476a21d
SHA1 b16f4af980c3b0298fb49bbd9928ed2650a84858
SHA512 41c5cd617baec2fac491b6b4d1111be1dcadf92292b8adc2307faa8bc218884ce8d0f6963767488260ffde8d381e2e5aa13cfa876a97f27a7489c593eab756c9
TLSH
T1C641095CA6E91148B3776E5A9BF6B46E487FB9772F07D45D10010D4F0A63A40CCA1B37
MD5 SHA1 SHA512 TLSH

Submit Download

3f0b89a4-9209-460f-be9c-3acd334e0edd.tmp

Path C:\Users\Admin\AppData\Local\Temp\3f0b89a4-9209-460f-be9c-3acd334e0edd.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

40c8ead7-59a3-4ca8-80b2-249582b7eb1a.tmp

Path C:\Users\Admin\AppData\Local\Temp\40c8ead7-59a3-4ca8-80b2-249582b7eb1a.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29b5751d-c0d5-4d12-93fc-d170467cd6ee.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4740_303407161\29b5751d-c0d5-4d12-93fc-d170467cd6ee.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4740_555534920\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download