hxxps://support[.]mcafee[.]com/serviceportal/faces/home/validaterequest

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://support.mcafee.com/serviceportal/faces/home/validaterequest
Sample260728-3rb5eszalg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3536	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297558783556858"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{F6A2F371-E938-4A14-B5C3-A546E47FD5BA}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{C51E5C1B-09F7-477C-9DD3-A4E345BF8A9E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2140	msedge.exe
2140	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 4984	4432	msedge.exe	85
PID 4432 wrote to memory of 3536	4432	msedge.exe	86
PID 4432 wrote to memory of 4808	4432	msedge.exe	87
PID 4432 wrote to memory of 4808	4432	msedge.exe	87
PID 4432 wrote to memory of 4808	4432	msedge.exe	87
PID 4432 wrote to memory of 4976	4432	msedge.exe	88
PID 4432 wrote to memory of 4976	4432	msedge.exe	88
PID 4432 wrote to memory of 3800	4432	msedge.exe	90
PID 4432 wrote to memory of 3800	4432	msedge.exe	90
PID 4432 wrote to memory of 2636	4432	msedge.exe	91
PID 4432 wrote to memory of 3800	4432	msedge.exe	90
PID 4432 wrote to memory of 2636	4432	msedge.exe	91
PID 4432 wrote to memory of 2636	4432	msedge.exe	91
PID 4432 wrote to memory of 2752	4432	msedge.exe	92
PID 4432 wrote to memory of 2752	4432	msedge.exe	92
PID 4432 wrote to memory of 2752	4432	msedge.exe	92
PID 4432 wrote to memory of 3276	4432	msedge.exe	93
PID 4432 wrote to memory of 3276	4432	msedge.exe	93
PID 4432 wrote to memory of 3276	4432	msedge.exe	93
PID 4432 wrote to memory of 3504	4432	msedge.exe	97
PID 4432 wrote to memory of 1080	4432	msedge.exe	98
PID 4432 wrote to memory of 3504	4432	msedge.exe	97
PID 4432 wrote to memory of 1080	4432	msedge.exe	98
PID 4432 wrote to memory of 1228	4432	msedge.exe	100
PID 4432 wrote to memory of 5048	4432	msedge.exe	102
PID 4432 wrote to memory of 5048	4432	msedge.exe	102
PID 4432 wrote to memory of 2144	4432	msedge.exe	103
PID 4432 wrote to memory of 1936	4432	msedge.exe	104
PID 4432 wrote to memory of 1936	4432	msedge.exe	104
PID 4432 wrote to memory of 1936	4432	msedge.exe	104
PID 4432 wrote to memory of 4792	4432	msedge.exe	105
PID 4432 wrote to memory of 4792	4432	msedge.exe	105
PID 4432 wrote to memory of 4792	4432	msedge.exe	105
PID 4432 wrote to memory of 3556	4432	msedge.exe	106
PID 4432 wrote to memory of 3556	4432	msedge.exe	106
PID 4432 wrote to memory of 3556	4432	msedge.exe	106
PID 4432 wrote to memory of 2416	4432	msedge.exe	112
PID 4432 wrote to memory of 3024	4432	msedge.exe	113
PID 4432 wrote to memory of 1164	4432	msedge.exe	114
PID 4432 wrote to memory of 2416	4432	msedge.exe	119
PID 4432 wrote to memory of 2416	4432	msedge.exe	119
PID 4432 wrote to memory of 2140	4432	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://support.mcafee.com/serviceportal/faces/home/validaterequest
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe6ef2c188,0x7ffe6ef2c194,0x7ffe6ef2c1a0
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,3433852120025416593,1671724269810079180,524288 --field-trial-handle=2180,i,3325309394134110641,10907113621433694412,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,8541514170068753615,17960544966195669768,262144 --field-trial-handle=2180,i,3325309394134110641,10907113621433694412,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,16385883431776770251,9314964377094550672,524288 --field-trial-handle=2180,i,3325309394134110641,10907113621433694412,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,16021970248056237828,438589545252405429,2097152 --field-trial-handle=2180,i,3325309394134110641,10907113621433694412,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,9354555956889489683,10006023560830638788,2097152 --field-trial-handle=2180,i,3325309394134110641,10907113621433694412,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,121526533445369835,12771049253170544589,2097152 --field-trial-handle=2180,i,3325309394134110641,10907113621433694412,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,271087003040701607,1247625389548801254,2097152 --field-trial-handle=2180,i,3325309394134110641,10907113621433694412,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,18172380991816369562,17412053639558855293,524288 --field-trial-handle=2180,i,3325309394134110641,10907113621433694412,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,12713413689045011485,12850808141509808731,524288 --field-trial-handle=2180,i,3325309394134110641,10907113621433694412,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,9520948942032831394,14677016475030703141,524288 --field-trial-handle=2180,i,3325309394134110641,10907113621433694412,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,9520948942032831394,14677016475030703141,524288 --field-trial-handle=2180,i,3325309394134110641,10907113621433694412,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,9161710450865533242,10184343805681181990,524288 --field-trial-handle=2180,i,3325309394134110641,10907113621433694412,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,3032528736958990955,736700327397189510,524288 --field-trial-handle=2180,i,3325309394134110641,10907113621433694412,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6664,i,6091777186350626309,3711312403863031528,2097152 --field-trial-handle=2180,i,3325309394134110641,10907113621433694412,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4492,i,3446135782307130563,13851042451365012857,2097152 --field-trial-handle=2180,i,3325309394134110641,10907113621433694412,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5780,i,10858961542225854138,11781400002887097223,2097152 --field-trial-handle=2180,i,3325309394134110641,10907113621433694412,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,12358394481988778887,6358079506579371404,524288 --field-trial-handle=2180,i,3325309394134110641,10907113621433694412,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6968,i,2087477595966630164,12789440878912028529,524288 --field-trial-handle=2180,i,3325309394134110641,10907113621433694412,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,16070582565678076308,11932207405909739296,524288 --field-trial-handle=2180,i,3325309394134110641,10907113621433694412,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,7626219797362800486,7609393745451554233,524288 --field-trial-handle=2180,i,3325309394134110641,10907113621433694412,262144 --variations-seed-version --mojo-platform-channel-handle=1004 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7224,i,13614515580998335986,5861381394141837226,262144 --field-trial-handle=2180,i,3325309394134110641,10907113621433694412,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2140

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 79KB
SHA256 1f1afc5a537a4572d744d48991a88cc1194df311f108fe06dfd0c4e2c3a9e2c3
MD5 93928bee2dbac9b5ebe8a559bbe6fb6d
SHA1 f374e7a9d87e8f8bf212dcffc238eb391efb0cc3
SHA512 c087bcd60ed07138b9aefae398a7ed1cf58b4162bcf9dd6a893b1cdf8db705a73aee7131b093baa3ecdcfc5a2e06d6144b77a76cd73ff2af57bb62fbd9b22b3f
SSDEEP 1536:sHBkHDY4HM6UNQMG13BhRRRiaHEOtaJnNVB5HqXU93Qt0kYMPyIO8K:shkjuNQp3DdlztWnSkOBYMHK
TLSH
T1DD8312E984669B70BAF0F42BB46E942E5F40E2FDAB7CF1D51DCA08454B088E5E027D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 22KB
SHA256 d475bc95c66edc6464d37680645a54c936c973ee47d19caea6d1874534d88b84
MD5 eb5af6b64d852801edfb6ce143cd190f
SHA1 56c88c5c5052e37058dae014c382ce35333438da
SHA512 34c6507ddcc910cb811bc79253a83cc4673062da27dac83870b79cc109875e7073d2d89bb10a550d5b12a27fee19d8479636e0101883158047164956d76255be
SSDEEP 384:/GsWDGPV/0jPzB/TotudzIVI5gaNFreqlqXfvAzCRg1dclfg:UG6zB1dm6gaNl1svvhRgctg
TLSH
T1C6A2E18A925113AC8F77D41722A4BB3766378E18DD020BAC889CB71127D9B4D7FD193E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a4
Size 55KB
SHA256 d2f945280e301a29f54944267607035346167e33b53f0c710423c267351a0163
MD5 1d73252f29f89fc21d69e822a9150f28
SHA1 78a846ae96b762135d3882f452e6a7e176963d64
SHA512 5193f8d9095ddeb7fd2db11be7d57adcb6ee5ef2d1ebf335c0663591576ebac20eba26b26c1c60a5d89e5d99e5fdf24ecc37b6f60662dd37d22890a93f78aa70
SSDEEP 192:hMAC/Q+2oYzJJss1LIhnIbIIOIFIlIDIreaiIsIJ5xdaiiUauSaZsRwaNI1qIpIg:hR1XY9yUi/MufCsJLEuo
TLSH
T1914337D9D8B00CB309AD3276576E1283B460D14798AC7E08B78D588C6F9CC2D7BB57AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0a75d2cdf22d9ca1_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0a75d2cdf22d9ca1_0
Size 283KB
SHA256 2898112a775a67cf344d65ce01de21f006d5e0df66d44939eb977219b8d496a2
MD5 a9662951675e7b3897dd38201f46b774
SHA1 ec1d3893f54a9470fad83b278b4ce4478ea52309
SHA512 56f1ae0f6d86b38c238547b34ded06619ac33a498bb3715dab3a8f84e30d84b556fd6e2f785af9a5ea6fc976a803167b3f3bd431aeb7a3697c58b2e9caa7b37f
SSDEEP 3072:lQHsRe3apLgPiTDbDXnzrvj/GQpHSNJQ20BUQQchjDVvzcHjQS4+RZPRsgHjHxY:+9apLgQD3nzrvj/VAQlJajQS46Rr7xY
TLSH
T16E54B6152790AE96CF3353F601528A17733649987FC39327B2E473393C1A2E65E9688F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87343dc183f0660b_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\87343dc183f0660b_0
Size 239B
SHA256 869362e2126ca3812bdadec59228726b2b154ccc601a8e477c53b306ac0f592f
MD5 24037ad14ae4e0721986efeb3899c211
SHA1 b3b33db2f4a1138900e48015982feffe4a4b20de
SHA512 a333ec2e0e0d67b7d33f5a9b0a2c30363ca8365d63c8dbf332693909d336bae8b7e704488da48169de966884fef264093e44b39b65e48bd7616a06e5e8a3d0ec
TLSH
T175D023AF117808C0DD0E2CF0CBB2B291F3094083C84CC8BB50402C233030A23CB82728
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 8317dcfff78dcda43128b14791f56b3f41f0051d6d1439bb9d29ff5c68b551f7
MD5 ca5bb5e1b2d7d874e01b778718fbed4a
SHA1 bab58d505b7cb0e684880f4756ca842bcaea87cc
SHA512 b2f0aa50668def676daad8492ad56098d2e984e3b671147725642998f40dd248062263842c298b413f43dcf5266ec472ce62e05e6c43d2095ae0c52e5957235b
SSDEEP 96:JvbGM4Lwz8IYXdJ8diUqBBSFQr7KKqBgIJJn:JDQkzEd0iUMoPn
TLSH
T168B1FC30218284ADE7A3D1323AD5DDF2B17D00CAFD1FAEB207445C35365AF90A82D9D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58a505.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a505.TMP
Size 3KB
SHA256 cba679e870d9d0398c512533b96ed2c5540d93947941279b925be27f22316cac
MD5 c558fff0be5bd71a996011f7099bcf26
SHA1 3da35bc6f4b75ec0a1d20b0c8acd40c07281dda8
SHA512 b10e6882ea221873002e9c804847fd4b5d1281bfc31578a88e1f3bc7c2cc5bbad41ab0ef1e79df2a24f4c11cfe4ad8f0b9b57b7bc201fd29bc56029a251e3422
TLSH
T1AC713B302206C46DD3B3C23274E22EF3B17540CAF9AFAE7550A4AD783581B91AC1E9D9
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.mcafee.com_0.indexeddb.leveldb\000003.log
Size 242KB
SHA256 d62fad93942c2ccd2109bc73e7269ec61c9fb3979fa7ec5583ec21b49799a6ca
MD5 536f137b33002b560598cf93b41f4340
SHA1 7034a033d8bde32269a1a378054b0c6f8902e405
SHA512 42e42ab61245be41bc433c1d66e3eaba832f78ac5ff87c2036f1fb1b9138ffa1ad05a9b8610079e9d1ac169e2acbb59f1bfb5a35ff7c6dbd329856b1825608e9
SSDEEP 3072:NWgP/5qVRh3Jd0mJaNLo4dU8Js89uYNyloPqgoIW52+OStLAk1CEKaNhED6Idxo9:uaQFF1aat9
TLSH
T11C34512A67EC561AF5B717BA5AFA3A9B49773C463D84CC2D50913F1C8933D010CA1A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.mcafee.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.mcafee.com_0.indexeddb.leveldb\LOG
Size 349B
SHA256 b95fe1084a67d8526d848d8320b56e0aa0f3e6930388d7da7f0aa0f4ef1e1325
MD5 16398e2cc782f2d27ba62e344f7f6cac
SHA1 0292ceffd6d964763e5493f268444ccd9c6382f9
SHA512 e51a24538b07ed49c96e300ebca6387aad7406aa31a22b872ffec7b31f5c8a3ec39f924241fde7060b5b0be4559116b3ce5ae9e41d012486e4152cc6bf113086
TLSH
T15BE0D86C85E9C11F51A454A619347B0DE993750F97CD7D850E45C9147043089D96D5D1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.mcafee.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 fc977ee92971d70bb6ce1dbd6542839da3b65f50ace0f64bbf57577c0ad28ae2
MD5 b329a4c49390e9aedb41e0a27c3a80cf
SHA1 5daab35baed80914fd8a1c9b87bb5723bc7b5f43
SHA512 68c914ab39a1c074ee9a5143c1868d6e12a22481116c1c65fd4e301684f2daa2d28dd2077d32fd8465c90ddeea2a2b1f9967f1d2868c210f32483fd926882567
SSDEEP 192:DmFCqhfCrf1ZiPkpgucJ+VpJiYh8qa5U/INkL1:DmFCqhfCrf1ZiPkpgucJ+VpJiYh8qa52
TLSH
T186D146EB83E5867ECD1156F4AA14AE1BCF190614531C382AC9E4BF0BE3E2472E11275F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 f4c93ff554c818b12670a3a36895607078545448d5096587a71e049af2a2339c
MD5 f40bdd395f9f982c0cdf0fa3d3d89a5e
SHA1 0b88a7be83408f21312268d327aaf17460969a15
SHA512 bbc05309e14727a73a1862eced9998dd244ee4f9927b50bb3d5adebf63ea61880855e0cf6abf88cd0782bb331f84b94ec2d58c7d0caf35bc5139d3681e6326f9
SSDEEP 192:DmFCqhfCrf1FPknucJ+VpJiYh8qa5U/INd2kXe1:DmFCqhfCrf1FPknucJ+VpJiYh8qa5U/F
TLSH
T1EED136FB83E5867ECD1156F8AA14AE1BCF190514531C382AC9E4BE0BE3E2472E11275B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d8d16456af242cb12dc0a8be105338575e88baf6b91f729dc6ebf08d4893de5a
MD5 c7c6ea4aadbd44be0827a2c03d44a508
SHA1 19f64db8be0cab2f22e3baa99c519ea132fe881b
SHA512 2ce6ec5a12f1d30dc9f85f08e571299d0d270c00750fd60d3a2eb4ca4e3c8ad0b59a2e542cc966ab5a83fb2f1c6606b8bacc98a285b9742d9176728420542dcf
SSDEEP 192:sxZKRnyM/jK1Ml8MkD/fQsf5PgnIdpZgHW6+WN1F7/YIxCQ2IgrJ:sxZKHMD/fQsf5PgoeHbL/W9
TLSH
T1F152D7166B389977CCDBD209F955BF53D6F90472D2941E44A9FCCA0C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 30df03696e591ff8dc90676c5a7330ccb6801332574499b261d9e3d6913d0b3b
MD5 978993b85ce3719a8d32b3f12ca03ac0
SHA1 f6cf902cf26e8c6795b388401a401cfec8acd66d
SHA512 36baa2cb1ce03fa856ded53ed9d20ef4fcc89cf3bb7407e30231a45341b70fc0cfb8edf391235dcc7debeb2f14ddc9afaacc4e8db3a19faf1d79e15a46a76bcc
SSDEEP 192:sxZKRnyMojK1Ml8UQekD/fQs85qghIdp3sHW6+WNmr8jWF7/YI9ZO2Ig5BJ:sxZKcq1D/fQs85qgKcHbJQ/Vd
TLSH
T10E62C7166A3859B7CCDBD209B945BF53E6F55472D2900E44AAFCCE0C04E7AEE220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ab1b8bca82ca3a2bda443238e1dd0d5730c62c921d2ad24a95c018db106668de
MD5 d5e369c302515241c4eda54ec610b10a
SHA1 d58f6332ff76f66784dd8cad16d490fe374c7e88
SHA512 a39d0d543e47ecd1d2e0764ff409f9e8bd45e67dfcd50d1b914dcc161bb88540ea236fd40aaa883d448028030ad19988a8ba86ba13c4d8faf8d07d891b137d8f
SSDEEP 192:sxZKRnyMojK1Ml8MkD/fQs85qghIdp3sHW6+WNmrS58F7/YIbZO2Ig5BJ:sxZKcMD/fQs85qgKcHbhe/Dd
TLSH
T17452C716AA3859B7CCDBD209B955BF53D6F51472D2901E44AAFC8E0C04E7BEE220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d0292d7779a3e8bcd679dd504099dae983abf48a358eae2606e811d100dd6c41
MD5 0d95c8fcc705824cb0790cb513e1a364
SHA1 19bf21b60d517617f391641a9d980fcda100ca7a
SHA512 9880676271de4e5256d8f6dd95af7db9182b0022358502cf395fe42e37b6272d0be16387acdab27b8a2c246894a5e804ccb178229266493af00e32233088229d
SSDEEP 192:sxZKRnyM/jK1Ml8MkD/fQs85PghIdpZsHW6+WNmpF7/YIxCQ2Ig5zJ:sxZKRMD/fQs85PgKyHbo/Wb
TLSH
T12F52D8166B3859B7CCDBD209FA45BF53D6F51462D2940E44A9FC9E0C04E6BEE220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 3510b1533793749291ffbbbe82ab4866baff18d693d482938385ee3987dd4182
MD5 eb39431682dfe6ff7953619eeeb0f77c
SHA1 f2ef8ef93f6c54c98b62d41deea75787639d2cee
SHA512 6691aed12621e30feda73162a90844f54309fbf6e5c7ce190b77c4095deea6f9e8effdcd6d53e37c1c85033004efb9857c294b9bb5982ee2877afb8962cf571e
SSDEEP 768:19sqxXlWvJD0T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9GrobdD:19sqxXlWvJD0Tu1ja54LAs99bJ
TLSH
T187E20B3B694CCB7D4F840E9DEC266ED76ED801CBA6988D5447FA880C03CB3EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 2a9d6aff6039fd965c00a65ac7d2cd5eca95764fb358631857ee9cdcf39f0c29
MD5 57cfa85762b36a4b9e9adfba96a8ce9c
SHA1 176119e69789caa0f2c9c83c6d759538a8ed411c
SHA512 5f5049a44625478512f476f5e3247ce0186021be2dc11093bbc711bae9cf744a8f079f51fdbb0781c31e1e466852f54a577ac939c221f8aba64d3f9e9f62907c
SSDEEP 96:KYbaKYIKGG0Kra2qyQKXqgPSKA0uSMAKhm1:ExTjHOJzu
TLSH
T139E18A1A71364652397E28A8B3A686775F4235633008B46F3FB840B54E6FE125DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 18KB
SHA256 d675bad1a758b07f1ed431a7812bf9fd82a0134557a9f1479faf96798a2a9d7c
MD5 f18b79a3435844f3cd10f1b52c52502d
SHA1 686226dff62991217fcaf2118b30364ed5b08220
SHA512 203b436d074f1f469ce6afb478f21e5847cb9adeecc4318aacd5ca131357810be9a8992d7737bd36a754ccc8f35273e30b64a8a51eacd17024779ac32e0ed767
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uP:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbA4
TLSH
T15482751CC52C7E3247C92F7D6A2F9D727ACA30CA7081459D798CC69DC31B06DA58A2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ae2a6921007f0fe40a93470ca7efb3db55174965bf6fe2280e0b2adb6fcb768d
MD5 225b8ea9a0c9f7e6dc182b4a896a789e
SHA1 0139a11c3d125fa5115c925e7e4f20e88e99d02b
SHA512 92d7568eb526351cf01b490dfac85cd1762385929ba606439120b59a8b6099aa62aaf8ac2cca2ad8214df2e28f8e662bbbe7ff92becc7bced43a64eded4f91d0
SSDEEP 384:4ZcIhsNzBkXbBb64VRNEOz/9awhScjmw7:GhlYuHEOj9awh1jv
TLSH
T125929E726E785C769EF6A445F88736139EB89073E7C81B8095ED9F0D01DA5BC030BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1ba0fa165d71213addaaca3d04dc1a574e08feb956d75c2f2c17f8e36e778628
MD5 dfd90ed3e42a506d5277e0f0f523e3c6
SHA1 1d125c9cddf5dc981ec7389dde45e731fd7bb7cd
SHA512 98b9f758e31b2931f28f6dc985f35e5e8c6454a1a9723ec63cd8222925ad9d975bf747fdac412ff594b97affc90631c28cadd29b82c136acd83f835c937f0992
SSDEEP 384:ciFiZcI1zsNN8TUNTUlIlYkXbBbE4VRNEOz/9aVhScjmw7:HFQNEwgJquHEOj9aVh1jv
TLSH
T1F6D229F259E7887ADAAE5747A77E2D034EBCC063F5845680B3D84A0CCD961BFC30A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f5ca337c76442968edcfa9575b7041c7a8f0e228511e6a57b74d8aff12e63334
MD5 372a53acd6979b0eb9801b3645dd828d
SHA1 c67f45c13abc5dd26529d9e9a576a054bcc26d86
SHA512 0e584702da8df7a568f70670ad7a3fd4d15999cbad09b32986e961ec8c21fa546fd4fe271ec0f955f3d45c350c8b80ff24ee3f8b403cf90718437277a771bb47
SSDEEP 192:tONnd6JkRtQmiUyqWW+RNEOmAeR1h3XRAU6:tONd6UrMW+RNEOzoyU6
TLSH
T19D02D835AD386C7B9EF2AE09B58B27175FE4206BE9856F80DAD81F0C01D765C1347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d45eea4bb4443976eb53245caac1f016f1c42ebc88c891d63bcb00ad618f5aab
MD5 2076abd7f6794961d8cc156e7390766c
SHA1 186ed1c08015a4488da6860c347f32d58f9e391f
SHA512 a5d11c6fe38269d09d20c09b7efa45f24858108ed148a2288922b6a9872616bcc05f334b62bd817e5a330fb7a6811148d5963c19218a5ac8df14e90520295c7a
SSDEEP 384:JZcIhsNzYkXbBb64VRNEOz/9awhScjmw7:BhiYuHEOj9awh1jv
TLSH
T143929D726E785C769EF6A445F88736139EB89073E7C81B8095ED9F0D01DA5BC030BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 80f1fc0a49a829676d88ab4139a69a4fd1c79a5e4f5bf4c2ca87bc3c361f4596
MD5 4e6a8c95b35e3e2e416c229cb251c4a2
SHA1 e6f9c3390e01e9669b2e39b2457e5d34cdc8ec89
SHA512 4c7c7c52d977564901ea2b70ca7b0aad93d8ad4250fab77f0779345cfca77b1e9a57153c44ac04397df4f5b1f8de136d5cb48e8119db0d8a0c03a6516694ade1
SSDEEP 192:YONO6JkRZQmiUy2WI+RNEOmAeRi99acVcoDqU4U6:YONO6U3yI+RNEOz/9a7hU6
TLSH
T157120A367D385C7B5EE36945F48732175EA9512BEA8A6F80D1DC1F0C01EFA9C130E92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

28aba854-5762-4b6e-848d-a838d50ed525.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\28aba854-5762-4b6e-848d-a838d50ed525.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6dbd9a7806675947a7c68072821586e0624454026495cf324310239b20fb4d06
MD5 ceed24d097d4c7da9c960439fd7b1ab9
SHA1 b33513a6737aa350f18a27a44b20c103c32df11b
SHA512 730e8e75f3b5cd657fd287e79c72d5e6d1ebaad8cf180c0a8a1073d4259c9289c24cbf2003e328d752b16127834967b4fd2949c595ffd5be5af9e32c4f4a24f0
TLSH
T10241F48DB6E91108B3B77E5A9BF6A86E487EB8772F16D45E00110D4F0622E41DC71737
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download