hxxps://safelivepost[.]com/ga/click/2-10368176-7-7465-21342-14040-4b5c3af3fb-4r86abd218

Analysis

user interaction
yes
max time kernel
898s
max time network
795s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://safelivepost.com/ga/click/2-10368176-7-7465-21342-14040-4b5c3af3fb-4r86abd218
Sample260808-c2pv6abc27

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1612	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306300850269655"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{08DD82E3-76DE-4D63-B506-0E1D8FE27DD2}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 3080	4860	msedge.exe	87
PID 4860 wrote to memory of 1256	4860	msedge.exe	88
PID 4860 wrote to memory of 1612	4860	msedge.exe	89
PID 4860 wrote to memory of 1256	4860	msedge.exe	88
PID 4860 wrote to memory of 1256	4860	msedge.exe	88
PID 4860 wrote to memory of 3560	4860	msedge.exe	91
PID 4860 wrote to memory of 3560	4860	msedge.exe	91
PID 4860 wrote to memory of 3968	4860	msedge.exe	92
PID 4860 wrote to memory of 3968	4860	msedge.exe	92
PID 4860 wrote to memory of 3968	4860	msedge.exe	92
PID 4860 wrote to memory of 3840	4860	msedge.exe	93
PID 4860 wrote to memory of 3840	4860	msedge.exe	93
PID 4860 wrote to memory of 3840	4860	msedge.exe	93
PID 4860 wrote to memory of 4768	4860	msedge.exe	94
PID 4860 wrote to memory of 4768	4860	msedge.exe	94
PID 4860 wrote to memory of 4768	4860	msedge.exe	94
PID 4860 wrote to memory of 1128	4860	msedge.exe	95
PID 4860 wrote to memory of 1128	4860	msedge.exe	95
PID 4860 wrote to memory of 1128	4860	msedge.exe	95
PID 4860 wrote to memory of 2592	4860	msedge.exe	99
PID 4860 wrote to memory of 1884	4860	msedge.exe	100
PID 4860 wrote to memory of 2592	4860	msedge.exe	99
PID 4860 wrote to memory of 1884	4860	msedge.exe	100
PID 4860 wrote to memory of 3672	4860	msedge.exe	102
PID 4860 wrote to memory of 2544	4860	msedge.exe	109
PID 4860 wrote to memory of 2544	4860	msedge.exe	109
PID 4860 wrote to memory of 2544	4860	msedge.exe	109
PID 4860 wrote to memory of 2040	4860	msedge.exe	113
PID 4860 wrote to memory of 2040	4860	msedge.exe	113
PID 4860 wrote to memory of 2040	4860	msedge.exe	113
PID 4860 wrote to memory of 4796	4860	msedge.exe	115
PID 4860 wrote to memory of 4796	4860	msedge.exe	115
PID 4860 wrote to memory of 4796	4860	msedge.exe	115
PID 4860 wrote to memory of 3640	4860	msedge.exe	118
PID 4860 wrote to memory of 4108	4860	msedge.exe	119
PID 4860 wrote to memory of 3672	4860	msedge.exe	120
PID 4860 wrote to memory of 2028	4860	msedge.exe	122
PID 4860 wrote to memory of 2028	4860	msedge.exe	122
PID 4860 wrote to memory of 3456	4860	msedge.exe	124
PID 4860 wrote to memory of 3456	4860	msedge.exe	124
PID 4860 wrote to memory of 3456	4860	msedge.exe	124
PID 4860 wrote to memory of 1472	4860	msedge.exe	125
PID 4860 wrote to memory of 1472	4860	msedge.exe	125
PID 4860 wrote to memory of 1884	4860	msedge.exe	126
PID 4860 wrote to memory of 1884	4860	msedge.exe	126
PID 4860 wrote to memory of 1884	4860	msedge.exe	126
PID 4860 wrote to memory of 3964	4860	msedge.exe	127
PID 4860 wrote to memory of 3964	4860	msedge.exe	127
PID 4860 wrote to memory of 3964	4860	msedge.exe	127
PID 4860 wrote to memory of 2948	4860	msedge.exe	128
PID 4860 wrote to memory of 2948	4860	msedge.exe	128
PID 4860 wrote to memory of 2948	4860	msedge.exe	128
PID 4860 wrote to memory of 1676	4860	msedge.exe	129
PID 4860 wrote to memory of 3648	4860	msedge.exe	130
PID 4860 wrote to memory of 3648	4860	msedge.exe	130
PID 4860 wrote to memory of 5112	4860	msedge.exe	131
PID 4860 wrote to memory of 5112	4860	msedge.exe	131
PID 4860 wrote to memory of 4052	4860	msedge.exe	132
PID 4860 wrote to memory of 4052	4860	msedge.exe	132
PID 4860 wrote to memory of 1096	4860	msedge.exe	135
PID 4860 wrote to memory of 1096	4860	msedge.exe	135
PID 4860 wrote to memory of 4752	4860	msedge.exe	136
PID 4860 wrote to memory of 4752	4860	msedge.exe	136
PID 4860 wrote to memory of 1632	4860	msedge.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://safelivepost.com/ga/click/2-10368176-7-7465-21342-14040-4b5c3af3fb-4r86abd218
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fffe223c188,0x7fffe223c194,0x7fffe223c1a0
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1896,i,5928422721766390214,931323125595553908,262144 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2028,i,1328783005376063941,4737230010410114647,524288 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,918603485537472201,5498004080404872912,524288 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,3549978809193576573,17759252127621613303,2097152 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,1146998385786272802,721978036537172694,2097152 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,5694366330402899467,9969321611491990667,2097152 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,1616467889708810213,11352480980909033643,2097152 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:2
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,12045855097174218632,3175756962053901440,524288 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,6616725780362705310,7303792084253271941,524288 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,1437150722054325545,14368055193325503579,524288 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,1437150722054325545,14368055193325503579,524288 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6352,i,17832689831790906428,7827776908150458907,2097152 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5892,i,5364612524467610411,16408139859020570548,2097152 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6364,i,10571640762102131306,6988167623337653846,2097152 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,4183406571111169071,9657702498055629528,524288 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,2296687694447573301,14939578893765911978,524288 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,836435886029203848,4264859211824346372,524288 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4008,i,17720451476866716700,16405086035127746159,524288 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6388,i,12351123391042659778,4927748177398140514,2097152 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,6058189497911803344,905978778446993241,524288 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6476,i,5947997003077732482,1327245536650689714,2097152 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5180,i,16198830769504189848,16930162366187154072,2097152 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6400,i,8823981629848979596,3963824918937517633,2097152 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6676,i,10756703751148756425,6835812636257827310,262144 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,2370218319387574525,7850554824674694835,524288 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,4759789073769165990,7586748446016880945,524288 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1316,i,2633195455285595761,12342108060377663625,524288 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,8024678751488129316,4215663351709120308,524288 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7080,i,2163375046732048845,6167307180032164516,524288 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1048,i,3457495965848445795,5520973659937603147,524288 --field-trial-handle=2228,i,3048783902015945380,17703109619043301526,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:8
  2⤵
  PID:1632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 9400f49bb75f5e5cfd1ed73433b45f19ba167de6486e5474c923655dc3c035ee
MD5 7141832e5ed04711dbc56e70926234ad
SHA1 edbb1037f64c9c9a1c592681d28711b03309acd0
SHA512 5c58517f0baa2523722b087b74002f683b30251954651f22f5113eac2adb9f1d4f792381d75fa9d28e8050e993247832945c871fe07279f8a3e337667062a31a
TLSH
T10DE0268426D8C3BEDA10AD8B6564470CC3C0372BDACAE90B6710C8DA3002044B382DA0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 15f534088455c03a1fa75e397a80e3af5f2df44ec5b695dbcd62727c7edc76b1
MD5 81d2819f0fa9af116c18c0b5aada9bad
SHA1 7703b9f32c97d87f3cb0a86d62f1b35a3ba0b957
SHA512 d760d6bff1daf76511ec38295797a21e7e6a0ca54b2fabb3290e0527c85d8403aba6cf25d398e7b627996334cc2a0c7e474ece5875e624ab3a85650d467714b4
TLSH
T1F6E0268915D8C23E9621AA4F7668430CC2D03B5ADECAE94B9B10848A3001640E3C2DB4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 8979bb541a42afb13b613d186b6e985a44d5545dee44205d6aa798c20b25582b
MD5 bbfb666aa1b285c67cd12d21b77f8801
SHA1 b8aefb388dafaaeb25c27d0d2028722146e384d0
SHA512 a2d97bfc22259b3c95531d2a8f6a692e8dd7ee6631f236ef111e5bd317465cf6ca4c15c3eb9404c58996f796eb70f9a4ed0dfb4a6a5c042c1cc0bd63dc6a15ed
TLSH
T180E026C928C8C22EDA10AA8F7168430CC2C1371FDECBE90F772884893005050A3C2DA1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 1a2630ba1a599f6f8e27aaf5c608212d7029db289ecdce6b5e0b1766dc6800cc
MD5 40625bdf4f8cbdf30553e15619b7b0ca
SHA1 6ff71f6ee7e9ac98653531aa31c13d51d07b6c2c
SHA512 ae74c73695a60dd45ae9053b2c611589aa400da0bb9f80913e30751fe6f4b22571c10d4cfcb4bb8cb16997cf705ebf1e4f67587624024e5f081d396f44443261
TLSH
T15FE0268918C8C2BEB720A98F6174A30CC2C1371A9FCAE99B5714888A7042944A7C2DA0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bb1b30a80b6a0e24bcc36f86f7d63cea37691cd935fefd53893d3b6eaef64326
MD5 173512bd63466f24e5636220da904a99
SHA1 83a95f4d8f86c59262faf0ee753196bcdb685ab2
SHA512 4f1212e8b9191a8dc8a04a442bb3e1318d58fa5303a4acda0e924a85c55a0626bc61146b8bad4213936e36e310afad98704987e540048cb95e74a365e185d0f6
TLSH
T12A6191380F8601A4FBA2037157D1C252B47D82E7FC93DE96D3B009F44BF57228A19B4A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5626a42022bccdbb3bc1790898b9d10c9d618eea88b717183285c118f541c428
MD5 1c92bb4bcd0a45f21119ce69d36717d7
SHA1 1ca657cbe3a6eee32e1c9a791bb871a963ed3e26
SHA512 40c08ad1fd7936b948014b6446512cd2511dd054684caa13e1ca49ed1575d48cd8587e8749101c1a0841d2ca8893ba5ba00366bd4b68e56c0374ee2454b8c9a9
TLSH
T10471B5340F8685A4FBA2033157D1C612787D82E7FC97DE46D3B009F44BF27268A1AB5A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589381.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589381.TMP
Size 3KB
SHA256 a57a55e39193d293c2c27e1f8553b046434bdcebe4a8f40631d3caf303e1ecea
MD5 2160ca488b2ffdfaba72533b02ac1776
SHA1 7eaf9a2b2a41eeb7f05546514b4ced015a7e5b82
SHA512 e1633b8b32a0444e263008bc9d4a0ef2114b2bd0f6f8f5667d58772c3b4a3bf827c197e6888201261bb93134f79848efb457999b9c6755f7803e1eb8749ebf60
TLSH
T1A26170380F8605A4FB62037197D1C252B47D86E7FC93DE56E3B009F44BF57228A5974A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 067b447859385474f7da4c43782dda65f5c2033283d692fe35fea8e7ca64c00e
MD5 f5390980178ab745c4bc5efc722c9250
SHA1 baa990baaced3e8a7e0d64ae664b6d483bb6d350
SHA512 a46d2f7d18776796fd9463ee25f2a58a02496637037601127a06e2a2f778945968a77ce8c9262578ea0421f9c0a8785fa7ef331e8566d4265bf0dfd7d8b503e1
TLSH
T185117DB3C3D5856E890116F05A28AE2BCE6D0506431C7C15D9D4FF27D7E3075E00159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b3e572c161256c19995d80a106ccbbfbe31c8be82004c327b8287f11b9466039
MD5 13a98149d4033de9daddeaad5ff3bc22
SHA1 7c66e7a4395cf28ce4cd44a4be93acb250494493
SHA512 f5b4638dbd2d8a78ae6c8829c5bff37caab6c893f206b48b2804f4d80fc90061b497a26611e3b2d6cd9ce3b07cdb0cb007949623f3c3ae47bd5bbaeb60fe7b29
TLSH
T19751BDF386E4896ECC4156F4AA24BE1BCE5C0A29432C3D5DC9E8BE1763E3074D15169F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c2ea9644239deb5b7b0fb04e18995b6c662ad216871e2cf27f3cdda6250a9e89
MD5 bb162cca66ba5bc89396da1e89b4e11b
SHA1 9a266c2f21e1de9606e05f8408779665c1d4f4d5
SHA512 a0d5dc96e032f0ea599dcd46b5013f01e8c9cbfbf3fa229c647133db3aa48375f901f99610536aed6116e3a904c98dce9b8dd9a6513bd661ca805cd53100cb81
TLSH
T10651BBF386D4896EC84156F4AA24BE1BCE5C0A28432C3D5DC9E8BE1763E2474D15169F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bc46dc726a53433026f7db9f5c51e94a3cd15ab06a960f8e36d7b5279b0e11fa
MD5 bd9d765c28a453909a7601f3e3b3856f
SHA1 e7ad8b13fff6102e8f6080fae61532d4165d1f74
SHA512 90b0a047bf0ba6cee5cf9f6988b84c74be731a08414d80b7117ad6d09e3cd4f8742af6dadcb83828ab2e64c794d59de6d5677f245ecc7d72cca7ecf723224275
SSDEEP 192:sxZLR9yM/jK1Ml8Mko/fXsC1ZaldIdpJHW6+WNGYzcDTtfIgrJ:sxZLBMo/fXsCHa8JHbG/9
TLSH
T1FA42E7116A38A977CCCBD20DFA557F93D6F54472A2900E48A9FCDA1C04E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f1ce971fd10e4c7f7ce799f2d1c1eb4521575282681cb4ec60fe376e425a6933
MD5 e9d19aa0685365533d6832d376d85129
SHA1 c4775c5a1c2f4255e549daa2f622642b5ff5e0d4
SHA512 f35ec800e6ff7e9072502af199ef713c2e576c9eef7a36076e0330bcd1d3992da590ba3ecaa5b14914a597fe753a2d937ea30dbf086ee310fcd10002f3d9e848
SSDEEP 192:sxZLR9yM/jK1Ml8UQNko/fXst1ZQ2dIdpJ/ntHW6+WNaL0/YzZSTtfIg5XJ:sxZLzqmo/fXstHQLnHbD/TX
TLSH
T10C52E612AA385977CCDBD20DB951BF93D6F5446292900E48AAFCDA1C04E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d304eab25cc4d8d54725c648a2701906a9e4a8a239a0b54994c1c99a583f78ce
MD5 03bfc7dd0ddfb0299db8baf1225bc8e4
SHA1 64fc0e89d19380e81ba5ec67b2e2fad5195ce92a
SHA512 6b04bf881dcd2a5de9408eff587f9ba9ec378c40b259fd52e7db50c827826dfc70fd571db6c3678eb74b05c83b490ca45063a6747f82a1e194abb8d96c46aed4
SSDEEP 192:sxZLR9yM/jK1Ml8Mko/fXst1ZQadIdp1FHW6+WNaL0/YzJRTtfIg5XJ:sxZLzMo/fXstHQH3HbD/QX
TLSH
T17A52F812AA386977CCDBD20CBA517F53D6F5447392900E48AAFCDA1C04E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 871a0d16d7e14aca82d5e1f8c3457d3cefc053949e16c5f23325a36359be8b5b
MD5 d1835144ac315cf543b40c01478a98a1
SHA1 9a124f9c37cf52d3c5be5909fbbf239f3ce5b906
SHA512 ee0414f9c041be3c92284fa6ce7a3bc3c7426fdcd30e607ae0749310ec2f1d25d5fddf36112bb6982718250cda3d8535ede07e60c5e2b9e1c8cd850673826fde
SSDEEP 768:v2W7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSj4roIQiXYg:v2W7kf0Wvqidau1jaa5LA3jDng
TLSH
T197D2FA3B680CCB7E4F841E5CEC266F966ED801CB66988D5487FA884C03CB7EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 912B
SHA256 e6f93ceec2ab3318e011dedc61902e4a2c411d8ad2238e15ece00d53da870465
MD5 9bbfc362bea6d2957427ec57d5acf3ee
SHA1 398b73475bf4a8688828477a143443ec93c63031
SHA512 ba7681ef855695bb807fda9177e2cb9b5bf59f3e2fad2c441fbab8e5994bbd0df7e565b9c70a1db8084bf468dec2ede324fab07185bb35412c01eef63a1e753e
TLSH
T1F911FE464E96D92FEAA845F314BB60F83331CADC6322A267443C253A2C2734A680B0C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e58fb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe5e58fb.TMP
Size 912B
SHA256 0419a23eab144e7c20059e70be632542ebeee80dc8218f98c6c9aa6d27a1a94f
MD5 c7e4fe20188d407717e2431995e0d5f4
SHA1 92728a52263c034284d39e08218d691c808a9a9d
SHA512 2652fd438b586d5aa39e5ca656ff1180a07de9720b5889754c0561cc78b3c3671c4a2c5352ad8cb9a3963b0223059c743c3cda5fb3859f7884cfbef6adf3d6af
TLSH
T1EB11628687A28D1FE85445F700AA60F87330CD003372F7A3503E253E2C3638E5A470C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 0b043dc0ec8e1223c9ea25cc727e56a59c61c64a6c36a0afb72eba944e7383ee
MD5 8d077dde3b883ec776adcda66d29a31a
SHA1 e0ea6a4e22b1b9faaeffacb034fb1309b60a979d
SHA512 2f09b20412c8eb969aaa880f2964baff934ccac233fd3a04444999ae1a60cc71ae126a193ed5d79ee4d94c423cf8a6700acb0017d354c74e08994f2ff85f1fed
TLSH
T14FE068BB2DFB1920AC6F97C138B064A081853818C900EC0E302BA28770F2361240AC31
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 a7c8cdf7be42b2e0fca5070a22edc1f6922b3fc9db0bd7fffa1e44350d530a3f
MD5 b46415e60c70e7f9d17ae001369e6ad9
SHA1 765ae8e9ade9401e07630717adf47f09ab9fef31
SHA512 9b39e6f6a9c2c2da30806daef2b47ea2b92efe315bcf4e119baf3ab5f2ae4ac4ab5429964dfb5f7cbf320de41594c44e04164ee1f62dcd2f5a1083adcca67f7a
SSDEEP 192:s2t/kh4fjRTnMv2zLJ2W1yZBOfX8L6xWqkIsPITOSuhWMfKqzk7:s2F6JG
TLSH
T11ED1310B703A4601387D389DB2AB89365F4676A3751CA4AF7FB900A60D67E210DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c40f2fbb-98b1-4885-b703-a891b7d4e44a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c40f2fbb-98b1-4885-b703-a891b7d4e44a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6e2c6f4c4688fb5d956934d84a8f5e75220b4ac96643cb9ced20d0632b80dd4c
MD5 b5a1d3929175058e71489a9484d5cd38
SHA1 785e79876000591e6af2414f38ed60539e586b4d
SHA512 5572921fd9798c12624b7b3506041df1a288dad809b5cb52fb00fd53bef277f38a9759309abca096a2bcd3a75df34bd6d2b275ebc2dbc753e3ee56ef1ec8b4e2
SSDEEP 384:9ZcIhsNVTF8/bnb5la7dEh+CEJrPCcDVVZoJHWiCyN:lhY8rrMWuhPCcleHWi
TLSH
T179928E319C386D3699EAB105F59736038EF84037E7C46B94B6FDAB1D01AB7A81317819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 22dd152b85b2f5263b959fefc3947bc4d9729343ae138fad5b4123399a790c64
MD5 d3b9e47a2b5b72c2c8b951581d8b9019
SHA1 e97da4dd77aae6afbcd1492451618265cbabbe78
SHA512 5009e402817e653d65e4391db0e18676568e6524bbb3d43d9bbdcdd665b894c9ec13f83152c7a527dfd26eeb2e6958839a390eab28e849da28d2662000038bbb
SSDEEP 384:HiFiZcILzsNv8TUNTUlIlqF8/bnb5la7dEh+CEJrYCcDVVZoJHWiCyN:CFQf6wge8rrMWuhYCcleHWi
TLSH
T1D4A27E325C689D3BDDBAAB45F95A36038EF84077D6C0A764F7ED9A0C019B6AC1307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a8e83cf108700a76b235bbf5a9c36063e984abfd74b2dfcac5a9e712f3ea64fb
MD5 999b198fa6228d0d0d7c2433ef0ae8ff
SHA1 33b4e9178de73d8ab6eab7c130ea892b0a5bc672
SHA512 151aaffcdfc6b8d5bf617ec56273c17c06602eaa523bfd9760e9a24b9e6843c7acef31d6e3e4259fea310646199e765eac60fad6c978baf7d22c96a0a656fd48
SSDEEP 192:MON/64BAQmiUyIK1IW5GBPKlt+FdG8PohIaDYqU6:MON/6eA02WAdEhxrU6
TLSH
T17702E9346C797C6B9EB2AE45F98637175FE8113BE6846B44EAE85B0C00E775C234342B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 609ca0e09c14ae56ee0768f38f2ab11fd6606b7d7f748163df5294c711778b08
MD5 22524c33390b9d0eac99a9c5d0f95131
SHA1 9d8bb07f093326ede8004dc4bd1f924d9ed017b6
SHA512 3d355420153242d78de95ddc738958cccec7b40d5eb91640f16940eb8329e3b25a1dcdb13d1a9f664f5f9f7a8b5d13adf8e02b781cb320b2d3ee0a664da16578
SSDEEP 384:9ZcIhsNVqF8/bnb5la7dEh+CEJrPCcDVVZoJHWiCyN:lhb8rrMWuhPCcleHWi
TLSH
T110928E319C386D3699EAB105F59736038EF84037E7C46B94B6FDAB0D01AB7A8131B819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 951725b519c72164d9b882cc0f6c4047d442413b3e4c416fb7221ff88b267884
MD5 9f84eccb02dc3ddbcc6cfba223c884ed
SHA1 120ced54cd605f74014b5cb2a0da79d5f215ea17
SHA512 1aa584291b3e97c3418d3e9840fa6ea298340430c1a2294072b9ed7cdf4f53e17f75ca5784b4f69b363d05d0b3b674d797ed7091433084d2126e32226e49e1b0
SSDEEP 192:cONY64B7QmiUyIkIG5GBPKlt+FdG8PohrGFC1SJraWwEqAU6:cONY6et1GAdEh+CEJrYCU6
TLSH
T103122B356C796C2B9DA27541F48736039EE8413BEA856F44F6EC6B1C01EF7AC2307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad5b2b5f-7794-4b8d-8bbb-06f4879f24f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ad5b2b5f-7794-4b8d-8bbb-06f4879f24f4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b5f466986f23c960bd3706e44fb33a0380abdec0b82cfe1dfdfc764ce10ee530
MD5 d8189917aefee54b73c82d1b80b8d602
SHA1 7c64b6383f9ab108d8911c57a00a93e1adc4c7fd
SHA512 8166e0f9605c7aff5efe799db669d9b429bbe5d3d099b81bce69aa7e911173affb82faace21dac44b84b30215e9018e3f812320ee1ca084a353a3f6b58316d00
TLSH
T1D3410B98B6F91148B3B76E5AABF7A86D847BBC372F46D45D00010E4E0622B00D971B37
MD5 SHA1 SHA512 TLSH

Submit Download