hxxp://199[.]231[.]191[.]240[:]8080/api/v1/build/download/agent-7fc1[.]exe

Analysis

user interaction
yes
max time kernel
568s
max time network
559s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 22:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://199.231.191.240:8080/api/v1/build/download/agent-7fc1.exe
Sample260808-144zvsdr61

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4696	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307008034344728"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{78D8A381-6541-467E-9D9B-268ABE0D0494}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5784	msedge.exe
5784	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 5452	1264	msedge.exe	88
PID 1264 wrote to memory of 4696	1264	msedge.exe	90
PID 1264 wrote to memory of 816	1264	msedge.exe	92
PID 1264 wrote to memory of 816	1264	msedge.exe	92
PID 1264 wrote to memory of 4700	1264	msedge.exe	91
PID 1264 wrote to memory of 4700	1264	msedge.exe	91
PID 1264 wrote to memory of 4700	1264	msedge.exe	91
PID 1264 wrote to memory of 3700	1264	msedge.exe	94
PID 1264 wrote to memory of 3700	1264	msedge.exe	94
PID 1264 wrote to memory of 3700	1264	msedge.exe	94
PID 1264 wrote to memory of 5648	1264	msedge.exe	95
PID 1264 wrote to memory of 5648	1264	msedge.exe	95
PID 1264 wrote to memory of 5648	1264	msedge.exe	95
PID 1264 wrote to memory of 3424	1264	msedge.exe	96
PID 1264 wrote to memory of 3424	1264	msedge.exe	96
PID 1264 wrote to memory of 3424	1264	msedge.exe	96
PID 1264 wrote to memory of 5720	1264	msedge.exe	97
PID 1264 wrote to memory of 5720	1264	msedge.exe	97
PID 1264 wrote to memory of 5720	1264	msedge.exe	97
PID 1264 wrote to memory of 2536	1264	msedge.exe	99
PID 1264 wrote to memory of 2596	1264	msedge.exe	100
PID 1264 wrote to memory of 2536	1264	msedge.exe	99
PID 1264 wrote to memory of 2596	1264	msedge.exe	100
PID 1264 wrote to memory of 2064	1264	msedge.exe	102
PID 1264 wrote to memory of 3352	1264	msedge.exe	105
PID 1264 wrote to memory of 3352	1264	msedge.exe	105
PID 1264 wrote to memory of 3352	1264	msedge.exe	105
PID 1264 wrote to memory of 236	1264	msedge.exe	106
PID 1264 wrote to memory of 236	1264	msedge.exe	106
PID 1264 wrote to memory of 236	1264	msedge.exe	106
PID 1264 wrote to memory of 1944	1264	msedge.exe	107
PID 1264 wrote to memory of 1944	1264	msedge.exe	107
PID 1264 wrote to memory of 1944	1264	msedge.exe	107
PID 1264 wrote to memory of 5972	1264	msedge.exe	108
PID 1264 wrote to memory of 5972	1264	msedge.exe	108
PID 1264 wrote to memory of 2856	1264	msedge.exe	109
PID 1264 wrote to memory of 2856	1264	msedge.exe	109
PID 1264 wrote to memory of 2856	1264	msedge.exe	109
PID 1264 wrote to memory of 4520	1264	msedge.exe	111
PID 1264 wrote to memory of 3492	1264	msedge.exe	112
PID 1264 wrote to memory of 2508	1264	msedge.exe	113
PID 1264 wrote to memory of 4652	1264	msedge.exe	114
PID 1264 wrote to memory of 4652	1264	msedge.exe	114
PID 1264 wrote to memory of 4652	1264	msedge.exe	114
PID 1264 wrote to memory of 2828	1264	msedge.exe	115
PID 1264 wrote to memory of 2828	1264	msedge.exe	115
PID 1264 wrote to memory of 4740	1264	msedge.exe	116
PID 1264 wrote to memory of 4740	1264	msedge.exe	116
PID 1264 wrote to memory of 4740	1264	msedge.exe	116
PID 1264 wrote to memory of 1248	1264	msedge.exe	117
PID 1264 wrote to memory of 1248	1264	msedge.exe	117
PID 1264 wrote to memory of 1248	1264	msedge.exe	117
PID 1264 wrote to memory of 2124	1264	msedge.exe	118
PID 1264 wrote to memory of 2124	1264	msedge.exe	118
PID 1264 wrote to memory of 2512	1264	msedge.exe	120
PID 1264 wrote to memory of 2512	1264	msedge.exe	120
PID 1264 wrote to memory of 2512	1264	msedge.exe	120
PID 1264 wrote to memory of 5784	1264	msedge.exe	121
PID 1264 wrote to memory of 5768	1264	msedge.exe	122
PID 1264 wrote to memory of 5768	1264	msedge.exe	122
PID 1264 wrote to memory of 5768	1264	msedge.exe	122
PID 1264 wrote to memory of 4680	1264	msedge.exe	123
PID 1264 wrote to memory of 4680	1264	msedge.exe	123
PID 1264 wrote to memory of 1852	1264	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://199.231.191.240:8080/api/v1/build/download/agent-7fc1.exe
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x168,0x288,0x7ffbd0fec188,0x7ffbd0fec194,0x7ffbd0fec1a0
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1664,i,52085444259211413,479384765447076421,524288 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1532,i,16616326986175170177,16487749937458217579,262144 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,14441692589152675625,12640459845597407472,524288 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:13
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3620,i,4210553531145728436,510666188300721162,2097152 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3664,i,2865371325663531334,14570053106013580560,2097152 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,1150352877269793224,13991807481211151170,2097152 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:9
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4356,i,15411022745829624673,4920135079232234185,2097152 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,3554794402076535934,6663001654793786701,524288 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:14
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,10479397429450284268,16312952152740652363,524288 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,17738929567768121893,15604098330159518565,524288 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,17738929567768121893,15604098330159518565,524288 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6568,i,10527500146030056517,12554885037018846214,2097152 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3764,i,14321237913674375508,6729585648541372065,2097152 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6716,i,12763169930338945207,7809335339412258165,2097152 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,7084185809361435423,17339424303773651307,524288 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4588,i,7537847316191548,15835673883097467954,2097152 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,10147560907144647478,14381422260388119750,524288 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,15338586426511938672,7374966283676744550,524288 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3884,i,18193055674451898700,3402255270280358663,524288 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:14
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4440,i,4030827141297355804,9004457149717436018,2097152 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3840,i,15747400104146896570,4344422222179003342,524288 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6784,i,14031376177622643585,1280855824694885985,2097152 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5484,i,33594479137670617,15542347840941162494,2097152 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,17734939693567166117,9057285856742258007,524288 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:14
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5824,i,13046336683345470126,6838413365292974085,2097152 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3784,i,14784997031037566781,9767197898092415650,262144 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6704,i,11628598201074844507,3204964003305994343,2097152 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,8782444122511709954,16490093607865616615,524288 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,6937958593684620387,6203863798373948526,524288 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,12037976381167637093,555703289120298771,524288 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:14
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,7886622183015347448,16494775852218357400,524288 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5432,i,5584851798800885989,4202985789437047961,2097152 --field-trial-handle=2176,i,2595206840371503278,7201008542902979793,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b9080c013cc79fccf3f72c607b6ea4ce47aa99dffae36c1a47807ca3d3360d21
MD5 18d14a20aebd944c4db8d36357370152
SHA1 b651b3d61ca7b13c1e7ccaf9de96f3d042ac67ca
SHA512 828df801686801bf712cdc830181878864c508524f561bd6d4e6c801f236df9c501691f164bd5ca8ccc9a40d6ee4a0e5fccb6301e56ec09e55e47081b27ec154
TLSH
T11BE020C514D4C35EBB0064CB62F9570CD2C8360A96D5E90F1F08844A7401888FFC1970
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 3a9b2d1293a66d950a5716ae74726eea2ea6cab33c9ea52fc7db12f53e1f8541
MD5 b4c6aff250e806a1bc9da9869128486b
SHA1 3bd2812e41f3123967cf92b3250786c0e62592fd
SHA512 33aa62355b8d751581305518e30d19251afabca8bfa995aeae022e694cee1c9194a777f34542fb0b3c34414157aea450c534238f7a07ef683be21e5caf30fd81
TLSH
T1CFE0209424C8C33DF904745F71B4534CD2D0360B96C5AA4F2708858E7041D94A3C3AF4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 61d42a7a905cbe464e717661f5bd076830bd8800c1a89900b7419fa73e20d5af
MD5 7637b6414b5855dcd3ad2cf0ce5d9b4c
SHA1 70c918b027457bb3c88f3e18c32dbc395a21767c
SHA512 935f1a0063cfe5ba69484cd98dad331601a3c769d89aca717634de6413e95ebf05b6ab477f8671c2e6b94567bc5bc84e61f7731395e570860736aec7ac7ebcdb
TLSH
T1C0E026A515C8C72EB647648FA178474C92D0364EAACAFA0B570884CD7001280A3C2AB0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 61fc14e2526680d8cbfc7debd8b364533778619e44144101c0712e905ce92180
MD5 c137dd6c766def986958d661377b270a
SHA1 64173c7ca2f07df611dcfc03621339e61915f058
SHA512 74524881de6350f2884242a3cdbed8c21bca5e89557242d738dbee9c6071e7ec0b4ee092d07d86d1843c5106b1d0dcbcb43b1b1b69ba26999ac8f184e393529a
TLSH
T123512C5CA37609DAE36047B2BCE384553FF58CAB09075E172080AE7859C6F075EC2E97
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 168dc735bb18111061e83acc922fa14ed7a002bc06106e0423e31fe72bf12ff5
MD5 1285295b3eaae2e4d17dae25d410b253
SHA1 ee8813fec75325d0e032104cf9fe6b3259c70083
SHA512 e7d63bb4347b1ebd4ae7bd0388481617964a97130a2f1f4478a58ee68177825c74e2b678feaf539eecac7d1ba37f92bd3f186e77cb876178ba6b8a06ce19a3bf
TLSH
T1D731BEF783F5856E8A1196F0AA18AE1FCE2C0515431C7C69C5E0AE2793F3472E042B6B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ae39276dce5c8b58fdf2bf5d4c7a558192cc4470dbd40233763e646697b176b5
MD5 999747b7470c9ee3b17314725a3c92ab
SHA1 4ea9dde81061ab9a9b74bfa970f16dd22787ba55
SHA512 8fe0894bdf59e0fef81b0004009811202168cec6d1da9f899c5e069a940c5329a7d2e5842466e7e3d74cccd58b8d645cb16974b6c1c733a8dd6b90817319e37d
TLSH
T17831BCF783F4957E8A1196F0AA14AE2FCE2D0515431C7C6AC9E0AE2793E3472E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1c6e3b49f1ffeb037a38d361b8cda15c6417aefef953ce281eedb2c2b05f84fe
MD5 927d3b4ed5dfa6aef7118825fddbd2a4
SHA1 faf9c4e75be83a35ba94bbee5a50b22e119bbd9f
SHA512 60686dc220bc4644303cc3bb6506292013b483f7131e7dd2b512970bf71e445a3140a2904fe15157a4ddc9f23cb9344f1e876937a897bd56406226903db69da0
SSDEEP 192:sxRPR7Oh/fysepwprQ57zoA8p9m/g6+WNUOL/YnUf9xKGdIgDzdJ:sxRPAh/fyseyHI/5t/BPbn
TLSH
T1AE42B7166968A97B8CCBE21DBB55BF53D2F9503271D01E58B7FC9A1C04E76CE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d317557d9571a497b0181630f2ad05c4dcd316a40b14cf83223fb72d449cb769
MD5 9ef5ca4b28bfd699605877de15bd08f6
SHA1 bf5ba279551e1e8eeb1b4779b2d9db8132ea94af
SHA512 18cabdedca9cf75c61687edbac4845c81d33a5beb6d84f6d1f0fa481efd3a24029972283e217687740e765702b7dd403f7325301d4db664ef738bc221ce6d570
SSDEEP 192:sxRPR7bh/fysePwprQ57zoA8p9O/g6+WNUA1/YnmUtxKGdIgDzLJ:sxRPth/fyseIHo/59/DEbd
TLSH
T10542D8166A28A97B8CC7D21DBB55BF53D6F95032B1D01E58B6FC9A1C04E76CE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 397cebc37173e80cda8bd0a7f888d804439c1d323404d324da67e9c92863a38b
MD5 c5424a2b4a7bf95e3182fed28d5c0121
SHA1 d03f7ecbdd6559958148406aab49a78e51d5365e
SHA512 a31bbd38e739eeb1f448c947d78c858b8be5ef6c483bd6f8fe8d87ea0e35b5d41177e5b92caf459f3c193cf9e1a0f3f4829a5b8eabedd9a72b6ea8cc48afd102
SSDEEP 192:sxRkR7bh/fysgPwprQ5HzoA8pi/g6+WNIYnYUtxKGdIgIJ:sxRkth/fysgIji/5I5Ebs
TLSH
T1E632B7166A68A83B8CC7E21DBB55BF53D6F9603271D41E18B6FC9A1C04EB6DE120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 c098c443a1c4098857a0faa75a53aa2778239309b0dc93f7f33d5cb96725b972
MD5 4f7abd851cc3dfa18ace0c1690ee1f02
SHA1 d2f29ce6df9457e3adf2757a0775dfa30b2e7735
SHA512 6d67b767b89fcf5eafaba03ea122f9efab3ba16df4b8a05689a2b622f3f1f4fe5ca14a4bae2d3866642423093d9ad174962d3494d9aba6718737ef7eb6b1046b
SSDEEP 384:wum8dzAfCtgoSFf6MKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVU494oRPvrohMb:wb8dz6Wgouf6M8F1+UoAYDCx9Tuqh0VA
TLSH
T1DAB2EB3B604DCB7E5F800AADEC19AFDB6D9C02C79A948D4447FE990C02C77EA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 ea5058094f377c2a58902c39513548bc341431fe1aa15fa559dfea2471492df8
MD5 7f96894eabedabd251a4f4b77f32d01e
SHA1 5c6f658d7b1685656c7e703afd6bcb04ad6e3bcc
SHA512 e3d6ac000fcd1a37449e8c9e7258f699f998f80329754e172a80ce64624541bcc280f6fe5539a737e899bd22e19e1730fd396ebe57af0b7f216988c0cb1fedb5
TLSH
T146E020773EF72804ECEFD7DB183264510551B454844DBD4F7815E2D714B336434A9C25
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ad3c58ac5bfb0dc2326efddb87e0e5d36dc8e5708981e0345a564aba4f12ce1a
MD5 c361e4ca333ca34d0666b4ab4d4fba84
SHA1 de7bdcaa9e1badecd5841e9ce43e7eae2401c91f
SHA512 db8197d91c824ad0854024d1e4448499d629f3418bef9fa4f9b3d6b681fccacd5d8c3480ffd33563967982b7d057fb2b3d5bda983bbede395afb7ce579efa026
SSDEEP 96:KRoZs4q26gWeDzgggK41gCgcwgziItHCHuC0UECWMZxgyCK4ngoCcSaBg1E4KR67:CoZs4q26neDsgU1gC/wgziItHCHuC0Ul
TLSH
T18B914451717F02443D7E6A0C85B8D85FE58174E2306CB86B7B9901A24BE7E024EFECD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 18KB
SHA256 d675bad1a758b07f1ed431a7812bf9fd82a0134557a9f1479faf96798a2a9d7c
MD5 f18b79a3435844f3cd10f1b52c52502d
SHA1 686226dff62991217fcaf2118b30364ed5b08220
SHA512 203b436d074f1f469ce6afb478f21e5847cb9adeecc4318aacd5ca131357810be9a8992d7737bd36a754ccc8f35273e30b64a8a51eacd17024779ac32e0ed767
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uP:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbA4
TLSH
T15482751CC52C7E3247C92F7D6A2F9D727ACA30CA7081459D798CC69DC31B06DA58A2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 11c8fbdaef7f0e7d57c2c55675215e14a3f5f15cbc703bf539ce3b08dbeefa33
MD5 6ade3c6ccf2b70bf05e1af72e4637a60
SHA1 a36d72648b778f14970ef521443a94b78dcadf66
SHA512 1f6ed3a075f781539bab2c16846a3f539110e66b92ff0b4f79ee73b82488eb2a117aa3499ba44e35114c1d9f5cbf48f0e8151e5ed6a80f023c0c5dbdf04abc69
SSDEEP 768:Zr3EjCZDZIO0nBJ8Nzc4ReyIsPO2ewBKZOyWy:Zr3eBJ8tc44bsG2evZFn
TLSH
T1B2F2B035BC649CB7ECE9A296F90732037DF49227D1D82AA4D6EDAF1C054729D034B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e22a70edeb8ff6aade787b98ad344784ad4a3f726c2d72dd5d0bf8345842fa04
MD5 372c884918cb0ef83b969db870a9d9f9
SHA1 7e650fd760217bee6057021f63e27016399b1757
SHA512 920695941eac11ef86a6b6d422708e3fcbfdddbd7525a2b968d5ea1d402359271926e00c5c56157d4a9de3ff590ffc1485dcebde19643f305cb69159abb6a5e9
SSDEEP 768:FB3RjTZDZIO0nBJ8Nzc4ReyIsPO2ewBKZOyWy:FB3CBJ8tc44bsG2evZFn
TLSH
T196F2B035BC349CB7ECE9A296F90732037DF49227D1D82AA4D6EDAF1C054729D034B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 7e87daa4094937a713a3a426942598e40082a422bdad5893085cc77c95e15773
MD5 1b8c97e7e952f3424bbdf27ff1bd5c40
SHA1 6c545e575fc84fcda677a852149c05aa15df7cf4
SHA512 4773caea9cd312a267bdf1b9eb16238cb76be0f20fae8663e488fbdb76c0fd4729c68fd3ea935e54fd616788407a63316948cd791118bbab64cc2455416eb88e
SSDEEP 768:CFQh35wgGjCZDZIO0nBJzNzc4ReyIsPO2ewBKZOyWy:Zh3YBJztc44bsG2evZFn
TLSH
T1E603BF32AC54C9BBECE99B86F90B3203ADF54267C1D86AA4D7DD9E0C15471DD034BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 da34aa2d7a1322554384a6c8ad21c540f7ae06584bbd44427d2be4db0a599ead
MD5 0335d5d9fc6537ca795e71b6389c3861
SHA1 1defc8fd7e40eb18e7ba24ac7e89ba0d1f5d2dd0
SHA512 e77e46fc5d71beb530069a45b553aa49cec2494facab8b4e0040f24f5a5d9fcf7c339b09632b0e0b4d2ebd34cf9c43d596162549178fce70f5f8bb0351b4c353
SSDEEP 768:Qrv+4UNbds3uvDZIO0nBJXNzc4ReyIs2OeVH1S5D:QbsbS3XBJXtc44bs1EH1Y
TLSH
T15B03CF32A8688977ACFA9686F44775033EF4522B82D81BD0C9DD6F4C4A8B1DD034F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 339d120b9997e31efc5677a5107c9ed9349033034e55eca42b4053ada640fd89
MD5 adb0a9d5becd78cce844dedbcb40be85
SHA1 8d42b3fee8c7f7fd7149df6ca4805706d6054d3a
SHA512 91e994a6a1d9135837a028ccf3f368a4bafd8f57a38cefba804e51ae181ff2934220dfbd060e8c78ebaab463d92a945a7e27ba156ede269e173ea808cd2411bb
SSDEEP 768:6rv+4UNbds3DfDZIO0bNzc4ReyIsXVeVH1S5D:6bsbS3ktc44bslEH1Y
TLSH
T18E03CF32A8788937ACFAA686B54775137EF8512B82D81BD0C5DE6F4C4A4B1DD130F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download