hxxps://securereader[.]uhsinc[.]com/securereader/help[.]jsf?lang=enus

Analysis

max time kernel
899s
max time network
733s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://securereader.uhsinc.com/securereader/help.jsf?lang=enus
Sample260924-vbksmaxbkg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4436	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134347445527586813"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{E45F78A5-652E-4A52-86CB-9A7A05E9C8CA}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 4068	2400	msedge.exe	87
PID 2400 wrote to memory of 4436	2400	msedge.exe	89
PID 2400 wrote to memory of 4164	2400	msedge.exe	90
PID 2400 wrote to memory of 4164	2400	msedge.exe	90
PID 2400 wrote to memory of 4164	2400	msedge.exe	90
PID 2400 wrote to memory of 2220	2400	msedge.exe	91
PID 2400 wrote to memory of 2220	2400	msedge.exe	91
PID 2400 wrote to memory of 908	2400	msedge.exe	92
PID 2400 wrote to memory of 908	2400	msedge.exe	92
PID 2400 wrote to memory of 908	2400	msedge.exe	92
PID 2400 wrote to memory of 760	2400	msedge.exe	93
PID 2400 wrote to memory of 760	2400	msedge.exe	93
PID 2400 wrote to memory of 760	2400	msedge.exe	93
PID 2400 wrote to memory of 2096	2400	msedge.exe	94
PID 2400 wrote to memory of 3536	2400	msedge.exe	95
PID 2400 wrote to memory of 2096	2400	msedge.exe	94
PID 2400 wrote to memory of 2096	2400	msedge.exe	94
PID 2400 wrote to memory of 3536	2400	msedge.exe	95
PID 2400 wrote to memory of 3536	2400	msedge.exe	95
PID 2400 wrote to memory of 2980	2400	msedge.exe	100
PID 2400 wrote to memory of 3372	2400	msedge.exe	101
PID 2400 wrote to memory of 2980	2400	msedge.exe	100
PID 2400 wrote to memory of 3372	2400	msedge.exe	101
PID 2400 wrote to memory of 4176	2400	msedge.exe	103
PID 2400 wrote to memory of 4792	2400	msedge.exe	113
PID 2400 wrote to memory of 3804	2400	msedge.exe	114
PID 2400 wrote to memory of 2452	2400	msedge.exe	115
PID 2400 wrote to memory of 2640	2400	msedge.exe	124
PID 2400 wrote to memory of 2640	2400	msedge.exe	124
PID 2400 wrote to memory of 1636	2400	msedge.exe	128
PID 2400 wrote to memory of 4740	2400	msedge.exe	129
PID 2400 wrote to memory of 4740	2400	msedge.exe	129
PID 2400 wrote to memory of 4868	2400	msedge.exe	130
PID 2400 wrote to memory of 4868	2400	msedge.exe	130
PID 2400 wrote to memory of 4016	2400	msedge.exe	131
PID 2400 wrote to memory of 4016	2400	msedge.exe	131
PID 2400 wrote to memory of 3284	2400	msedge.exe	132
PID 2400 wrote to memory of 3284	2400	msedge.exe	132
PID 2400 wrote to memory of 812	2400	msedge.exe	133
PID 2400 wrote to memory of 812	2400	msedge.exe	133
PID 2400 wrote to memory of 1276	2400	msedge.exe	142
PID 2400 wrote to memory of 1276	2400	msedge.exe	142

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://securereader.uhsinc.com/securereader/help.jsf?lang=enus
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffe1bb8c188,0x7ffe1bb8c194,0x7ffe1bb8c1a0
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,12328426821301232146,160013063224726801,524288 --field-trial-handle=2268,i,3188401678754718456,9280551851697152366,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1832,i,16777007334436016896,9380195754819222590,262144 --field-trial-handle=2268,i,3188401678754718456,9280551851697152366,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,1014085503121500163,17393227919687061947,524288 --field-trial-handle=2268,i,3188401678754718456,9280551851697152366,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,9810877647849932690,9273010809564178333,2097152 --field-trial-handle=2268,i,3188401678754718456,9280551851697152366,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,16030377214096379893,6823400963454830701,2097152 --field-trial-handle=2268,i,3188401678754718456,9280551851697152366,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,5631352908082571841,4794921572430285811,2097152 --field-trial-handle=2268,i,3188401678754718456,9280551851697152366,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,13164306204067134678,4120743184976751170,2097152 --field-trial-handle=2268,i,3188401678754718456,9280551851697152366,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:2
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,5178255744814992267,7998312413527352208,524288 --field-trial-handle=2268,i,3188401678754718456,9280551851697152366,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,6097228492390541928,6068653466625287247,524288 --field-trial-handle=2268,i,3188401678754718456,9280551851697152366,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,3573439331617462834,11680743430231995687,524288 --field-trial-handle=2268,i,3188401678754718456,9280551851697152366,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,3573439331617462834,11680743430231995687,524288 --field-trial-handle=2268,i,3188401678754718456,9280551851697152366,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,4974952021952756130,863167988607903007,524288 --field-trial-handle=2268,i,3188401678754718456,9280551851697152366,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,17494617638720263347,4893038949141422410,524288 --field-trial-handle=2268,i,3188401678754718456,9280551851697152366,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,12515664577279381983,10176159489751151095,524288 --field-trial-handle=2268,i,3188401678754718456,9280551851697152366,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,1056046922369961138,1858479253136097105,524288 --field-trial-handle=2268,i,3188401678754718456,9280551851697152366,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4832,i,1753629064947313311,8899337918824333017,262144 --field-trial-handle=2268,i,3188401678754718456,9280551851697152366,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,7880719016937703449,15462036457250388059,524288 --field-trial-handle=2268,i,3188401678754718456,9280551851697152366,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3952,i,10550137752466776311,7371250698712053184,524288 --field-trial-handle=2268,i,3188401678754718456,9280551851697152366,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,15118481339377060722,785904774862178183,524288 --field-trial-handle=2268,i,3188401678754718456,9280551851697152366,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,2542966896187740281,9278731239586696917,524288 --field-trial-handle=2268,i,3188401678754718456,9280551851697152366,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,8338855632196428675,6028551830129018023,524288 --field-trial-handle=2268,i,3188401678754718456,9280551851697152366,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,1655501362263044229,7657556731521605130,524288 --field-trial-handle=2268,i,3188401678754718456,9280551851697152366,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:1276

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 0bdda2fb6ae2b1a5d748be168636c45e811fb71f33609d97b470906301367eda
MD5 094f7462a583e9b7739222e720b04df2
SHA1 98b804b895e52676507163ef53da670463c1a9c0
SHA512 f108951b6ef7d12103efd168b19bf41e5c0d2f88bad634c9e0bdad1272367e444982cd4512d34b8cc049ce732edf8d18d1c00a81ca42cd7337a80d30046cf8fc
TLSH
T12CE086DC9ACDC27FB6046487416DD74CC2A0370ED6CD7A8A1B14DC8D7941658A2A6EE1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 2b394e2fdfbb226acc6782de2979b35d5b6dfb19611fcc91daf08eb631bbe871
MD5 0e56f80c2f3ed03201539304f94b90e0
SHA1 cdae2bf3e7ab451c724881aa5a978b5eefbe76f2
SHA512 1ac690e7342f7f5921ec6ff7fa1b4fea50ab84c7d72b7e19f9a9f3b9e78c52bcad95f9e1be1b16f7ef7b91549ab4869f91769a68879de0ca5cadf133d2f4a793
TLSH
T142E0268885C8C3BEA64465C7416CAB4CD281370FA7CCAE0A2744CC857481940A6A6AF5
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 af7d5201e24ebea3eef1dc4e21749d7c04d4df9f5bda1b6022ba473fdc28eaa2
MD5 cd79a5b9bffaa90d16e37dcfe32b7c86
SHA1 9338268b9e4c4b49fb4110b64c418f1665915314
SHA512 f213426d35e2a439d13f69e1604c6aab1e82ce7759f46965c2611044054543bed04c2447c6b66163b92b81bbbb40021d3256b4a4a4bec050f10c6d48b81966dc
TLSH
T14E617263F1D08016F7D87AB887E52697317CD9C1DB83EF520558D439B84AB946A390D8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d69fd0f0ef47669f63d937e6809fea00c7de651d324b79d165880bc54cb88b67
MD5 4d0f75c45f8fe81bcd0558e3a6a556de
SHA1 d8b30ecd92779bc892567915a63e4a2b9855b1f4
SHA512 9cd73c6355a5cfde8ce8f3a989dd23da2bf473fde19a1df6a84e985dad9b232e06737d008b278864000caae4d2aabb491fd52ea7470af4fceeee27dc07f8d03a
TLSH
T1EF21BEF783E185AEC91156F09A14EE2BCE5C0505821C3D6986D4FF67D3F3071E002A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 4a7dd249d7ec3cf31b94ec2c9df6102910a11c92441f9ca927958b6af4f4730f
MD5 c74b352ce3e0e9653503ae446dc36ca6
SHA1 142c285795dab43cfc5cf206f628e67602f02e6d
SHA512 f327b2e9f2149d80a0671b38654026477e91b902b0d6c6b49eab1ce0cfd64aa07c992e088b2baca9acc342ebebbff020cbc9b68bb52b9bb3485b1398e8eb7db5
TLSH
T188117DB7C3E5956E890516F06A24AE2BCE1D0A06422C7D59C5D4EF2793E3075E10156B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 fe06e5439fe64435f1f90650350e9c45e9613a98e4db43fccf022c493a0a5c8e
MD5 7a364671b9062ac8c13f7a3b7fe318b1
SHA1 1b99533607dddacb9aaa9f598e8e7ac413930e87
SHA512 d9fe31a3ce3457e81c9c538af85016ab0cb69fbc351772f6b4c20ca6575683bebcf671ce29e6f57b5ffe2060bebdc5009bf0436ea14aed76733b0e42c622a531
SSDEEP 192:sxZzRcW4/fVspEIdpmNHW6+WN5ul/Y332JIgrJ:sxZzB4/fVspdSHb+/v9
TLSH
T1A922B7526E28A57B8CC7E20DBA25BF53E6F9503295D51E48EAFC871C08E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 63db90cfe6e21c52cc84cb393384892e787dd21e8fd415420c57d88020cfe0b1
MD5 08cd60ad73682ed2806774c954bd0355
SHA1 53a265e0c92fe89d9a8b5532ab0eff64b264a76a
SHA512 c8c3d4dffed13293d062b4f513f43d76dc924711e86bbae6517b6ac3f0396c9d1ebe7744a90ec69dddd8cd8fda04221bd2efbfb51f78024b07824602532e37d3
SSDEEP 192:sxZzRcW4/fVs0EIdpQNHW6+WN5ul/Y3H2JIg5DrJ:sxZzB4/fVs0dkHb+/lH
TLSH
T10B22D6566E28697B8CC7E20DBA25BF53E6F9503291911E48A6FCC71C09E7BCD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 24KB
SHA256 3941066819eef75984a3eeef12713603ad3e631af0c76e47cd32237aa634d568
MD5 8786531166a55bb74beaa6a13c03c0b3
SHA1 d109cb6175a19ed5716150c308d15436096b03e1
SHA512 1bb5a0e5c218e39a7f81cdc6a4ee8926a45829e0108e6b4fced40add35c9356d2afee2727fabb7ba5585018077bfe0e591c0d4cf126c9def33239b46c5faeb07
SSDEEP 384:sxZzB4/fVsC66s8qMpRiYnazAW8pZS15posJWeT+xoXdkHb+/AH:srB4/fN4Mnc7WeT+c+HbEm
TLSH
T1B9B20805A924C83B9EC3AD18693D7E33EAEC506212C5DEDE56ECCA1C019E1FDAB47417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 025e53ecc244f496a64c38feb86b84902e2b8fe2598a85a38166121e66346abd
MD5 8e579ecef022350e5a5023e523a0c50b
SHA1 092a69edf09f3300971eb6410cd8c5b93ee2af08
SHA512 96d68304bbd380424facb4bf97010b72255c2eb4affa45ba3b43487e436c6289313fa49df891fbb8ed9219b7665289d2e14c4a85be051959995b269a0c3d2c8c
SSDEEP 192:sxZzRcW4/fVs0EIdpmNHW6+WN5ul/Y3d2JIg5DrJ:sxZzB4/fVs0dSHb+/TH
TLSH
T17C22C6566E28697B8CC6E20DBA25BF53E6F9503291951E48A6FCC71C09E7BCD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3034fa7cda8cf46969c26c6720869997915ea91779d8bc7c98f53340b2adea87
MD5 2232d649bdf35cb37b54dcbd64ab2d45
SHA1 912468b03e4fbb8f8451f4278f0b143e54ab2283
SHA512 293b590706e0ea61fa7914a228c9eb575536100256c227c09fda66db0acd92a0284a25fe6d7df68f566d290f0b38b5f9909a486a82ba5e0f28be7f5ec3da918f
SSDEEP 192:sxZzRcW4/fVsSEIdpmNHW6+WN5ul/Y332JIg5DxJ:sxZzB4/fVsSdSHb+/vh
TLSH
T11E22B6566E28A97B8CC6D20DBA25BF53E6F9503291D51E48AAFC871C08E77CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b07ac012d4720dbfc72de565c2169fd8710bdca2e12d6c10b759080a9aa2131b
MD5 88813f11d3ea2f2376357d3dd321470b
SHA1 3b1782394ebd05095667276b523e202138c83037
SHA512 71bd449fb4b21168a4a56793c080e59a51e50faf0d1ed54e29bea0ec06d6419539036cedeb1325ff1f0cf8a4197bf029f5b215f55150b2e22a38ab4ab0378e88
SSDEEP 768:Sa30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72GrolZMqp:Sa30AbSWvS2l9u1jaLmLZ1293p
TLSH
T186C2EA3B640CCB7E4FC01A9DDC6AAF9B6E9C02C796548D4047FA984C02C77EA91274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4f3a185e-5bc2-4345-ae38-581f252b2759\index-dir\the-real-index
Size 552B
SHA256 d7230536210b5f41ae8ce148f4531970bd7e0b2fc32c925a26f44929779596b0
MD5 4c9b52408e43565ef091095e3f263f11
SHA1 66e8d872c72dcfd0b910b34fd1ca0455ed72e3f8
SHA512 a1018213c9cde3d0c87bcf6f32e1002559624bfe221ecf9f08fb0c766e4de30c92ff3d1f6cc555168c5c8858e6ca2d1628d78b40c4b34e1e0a1df86ed7e1565c
TLSH
T14DF0F1DB3E13460AFC184135347D745165B162EC53902E0FB0FCC0259C97384DE416A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d52c6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4f3a185e-5bc2-4345-ae38-581f252b2759\index-dir\the-real-index~RFe5d52c6.TMP
Size 552B
SHA256 8c68b26cd78ff851bb564a15b69e0a21cd21d3a1de4e063f595e1431383af7cb
MD5 f6449580cc28f3b7d7ccf2e288cd71e6
SHA1 3ab66bae2c4ab09298b83ac9bb6a94eabb3610e4
SHA512 c97624cbfd5b907d710e2b9829c01ec0e6b49576fa8a2250d2aa6216f3a53e79e39dda3f3f8368d7dbe15ffc010c64c517302627313dbad162289605a23d8d19
TLSH
T1DFF0F1D851134746FC040131A67D615561B150089314390FB1E59065CC43780DD82BF5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 2c9d1e91d028a809991a8cdc2a2f9cfa47474ba57ff23404f4d1edd15dcda2c0
MD5 287da80f98504fc9c9c90614c6f6b462
SHA1 941313d1c3ce2eb395329db50ac0a6b40a783221
SHA512 4f9d7a073174f8f7db85ed1936436769e0746afccff7f7ec9869d73ea85a14de588561d9dcd8c61ad31e63a55bf7d81213ae35991fa922f674f82d518ca21a0a
TLSH
T12AE0C0F32DF71851FCEFC3D4147088B181057898DA08FC4F50AAA7CBA4703113845C10
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6404318729150e453d002004806b39f0d38b99c08beef91134237581ddc739ec
MD5 93e88ee3419d1d823c119dab5c69a172
SHA1 64ed2787983699319b7e5bac848deed361878aa7
SHA512 6dbc240429a7bd31ab1a6568f970264234b8db3e57d155e5916ed90b4d7608e2fa18bd0d4ee0a6ead517bde8dcbd845466194ebb8f3c83253a699b0d507ea73b
SSDEEP 96:Kh4rk4iqqOI6FViYOK67i+OmAYdOIPPZY/DRT/zIveCiLzK6qitzmJhW3Kw4KRaz:AdXQTy
TLSH
T1C391348535BB02003D7D294D81B5977A02A272B27048F73B7BB952E66D2BD180EFF5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb301c97-56f3-415e-8437-5ed1907d8176.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\eb301c97-56f3-415e-8437-5ed1907d8176.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7ec1fc0768c2f3ed2d9db3b25ecbc7de8fd9f0651c96392ce82aaf1d697e5a7a
MD5 ad17423b3d42bc8dbb3f18cb42d2c709
SHA1 8e53a8b6eb90d33a4cf1655b1b03a55941cb8336
SHA512 223b2934109c3c7d6b4e29c22a58c881f020d9f78034b6fc2c5ba40378300670e406af875c58db99d9916ccec051dd593bd9470a54d241bd0d6b4d62434c0d02
SSDEEP 384:0ZcIhsNFxbTGpunPe9iX5F+JOq4XwTeUCdiCoW:yhe3G+KaiJp4Xwenl
TLSH
T181828D3689B8AC7A5DE3D555F4463603AFB89027D7C82F80D9ED772E02EA594030BD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c7222128bbf102166ed586d6a92af574a7381f803256770d4bcc739c902b43a8
MD5 b75ade8385ab09666b3e6c34e1aa694c
SHA1 f7464432a274258ab304b8056929d154d12c9e9e
SHA512 028dcffc9cbdc736dfa989669214ac0663a715b2e28b69477d60b04a20afacd498a42e485ef7af9549ec6456cfb0d2f9ec1aecd65438ee28b150a0741276e87f
SSDEEP 384:ciFiZcI6zsNf8TUNTUlIl2bTGpunke9iX5F+JOH4XwTeUCdiCoW:HFQSWwgI3GRKaiJ24Xwenl
TLSH
T1A5C22AF248D7987AD9AE8B57A73D3E039EBCC063B5845A40B7D8661DCD960BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 75d5ca4655299000ced6cb8df12fb3e4384d29b384623e7f738c243f695b23fc
MD5 8fbe412a73497f6dad1f4694c6f29e92
SHA1 26c323c34cf1a869054b09dee863739be2282c36
SHA512 6acbd89d5dbdd0a0c8725541edbba6c7ef9b50e93c54d6ae44b0ac9f0a1542338371638d603a673fa622be65b51d23f15a216d46f574370856f054ae271d95c2
SSDEEP 192:LON96AmwprQmiUyR76siX5FbyhjkQJi4XurU6:LON96ipdG6siX5F+Jw4EU6
TLSH
T1A002E835EC686C7B8EE39E19B58736136FA5116BDA952F44CAE82B2C01E764C1307833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 bb4d7c0dae4e952e13a117f4958822b3ac774f9335cbbc0ab02aa01b13265f08
MD5 8f8b21d541a4b97c1ed747e62759e13f
SHA1 f2c8ffa8e637f4ac6882085c890f6143efc1d2f7
SHA512 b9021d7e0da05ee3750ac8ba0fca6eaa139e615214fe1b5cf097c2564ddf321070f9612e66b6e505f2f1a1443c6a5186be40206b60eebcdc9f1eebd2f63bf225
SSDEEP 384:DZcIhsNF2bTGpunPe9iX5F+JOq4XwTeUCdiCoW:bhH3G+KaiJp4Xwenl
TLSH
T108828D3699B8AC7A5DE3E555F4463603AFB89027D7C82F80D9ED771E02EA594030BD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e65ebb00ab2aad0e84df344508a724de7d2ff3a175cf409d32b675415202349c
MD5 1ed9a3036a03257410a051f10a403732
SHA1 5b5fc9b8f7aeeeca2f9d30a662a210bebcc31b3b
SHA512 7c4a1c15f13e336de033696f9b39be9f55a19af865c03f6e5e05a01e6334ef15b9e878c8c6db785de014ee782f3a5ce6d85dfe0b4a69ffde72968f80dbd907e0
SSDEEP 192:LON46AmwpXQmiUy67asiX5FbyhjkzEe+fdlR4P/3U6:LON46ip5PasiX5F+JOa4XU6
TLSH
T1EF120935E8B86C7B4D93D564B08735135EA4512BDBC96F54DAEC3B2C02EB59C530B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

844134e3-bfcd-4863-9766-45d3c588c715.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\844134e3-bfcd-4863-9766-45d3c588c715.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e2ee42dbcf730f372c36e585e6d243582da858352185497686b5c93f32e39b1a
MD5 fe9af666edf64f4aca8064962382d50d
SHA1 b612912fe3e2a90c31d38cc948ad30be4b9c0b4f
SHA512 b443af177506f10e733d81324447e9811b4e9af9d6183f5349dcad6c7d7e2e78623d9d81c8a1640cca424630e9c1960be49df20c473371069aeecad758b8d2b0
TLSH
T1BB410B58B6FA1108B3B76F5A9BF6A46E047B7C372E0AD45D10110E4E4A67B40CCA1B37
MD5 SHA1 SHA512 TLSH

Submit Download