hxxps://www[.]coursera[.]org/api/rest/v1/eventing/infobatch

Analysis

user interaction
yes
max time kernel
898s
max time network
728s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.coursera.org/api/rest/v1/eventing/infobatch
Sample260817-dmktbsswhy

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3148	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314096618506104"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{DCF11054-5BE8-4C32-9658-24686E107752}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1108	msedge.exe
1108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 1452	728	msedge.exe	84
PID 728 wrote to memory of 3148	728	msedge.exe	86
PID 728 wrote to memory of 1688	728	msedge.exe	87
PID 728 wrote to memory of 4388	728	msedge.exe	88
PID 728 wrote to memory of 1688	728	msedge.exe	87
PID 728 wrote to memory of 1688	728	msedge.exe	87
PID 728 wrote to memory of 4388	728	msedge.exe	88
PID 728 wrote to memory of 4164	728	msedge.exe	89
PID 728 wrote to memory of 1676	728	msedge.exe	90
PID 728 wrote to memory of 4164	728	msedge.exe	89
PID 728 wrote to memory of 4164	728	msedge.exe	89
PID 728 wrote to memory of 1676	728	msedge.exe	90
PID 728 wrote to memory of 1676	728	msedge.exe	90
PID 728 wrote to memory of 4512	728	msedge.exe	91
PID 728 wrote to memory of 3348	728	msedge.exe	92
PID 728 wrote to memory of 4512	728	msedge.exe	91
PID 728 wrote to memory of 4512	728	msedge.exe	91
PID 728 wrote to memory of 3348	728	msedge.exe	92
PID 728 wrote to memory of 3348	728	msedge.exe	92
PID 728 wrote to memory of 4004	728	msedge.exe	98
PID 728 wrote to memory of 3512	728	msedge.exe	99
PID 728 wrote to memory of 4004	728	msedge.exe	98
PID 728 wrote to memory of 3512	728	msedge.exe	99
PID 728 wrote to memory of 2924	728	msedge.exe	101
PID 728 wrote to memory of 3932	728	msedge.exe	116
PID 728 wrote to memory of 2812	728	msedge.exe	117
PID 728 wrote to memory of 3904	728	msedge.exe	118
PID 728 wrote to memory of 1084	728	msedge.exe	125
PID 728 wrote to memory of 1084	728	msedge.exe	125
PID 728 wrote to memory of 1108	728	msedge.exe	130
PID 728 wrote to memory of 3272	728	msedge.exe	131
PID 728 wrote to memory of 1776	728	msedge.exe	132
PID 728 wrote to memory of 3272	728	msedge.exe	131
PID 728 wrote to memory of 1776	728	msedge.exe	132
PID 728 wrote to memory of 436	728	msedge.exe	133
PID 728 wrote to memory of 436	728	msedge.exe	133
PID 728 wrote to memory of 2812	728	msedge.exe	136
PID 728 wrote to memory of 2812	728	msedge.exe	136
PID 728 wrote to memory of 3636	728	msedge.exe	137
PID 728 wrote to memory of 3636	728	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.coursera.org/api/rest/v1/eventing/infobatch
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffdf3d5c188,0x7ffdf3d5c194,0x7ffdf3d5c1a0
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,839463233466058915,1088336866872669367,524288 --field-trial-handle=2712,i,13311033682700825640,7952161348430916764,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,14590450952374250325,1006834923582456195,262144 --field-trial-handle=2712,i,13311033682700825640,7952161348430916764,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:2
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,14555022737982348166,13294984282796649995,524288 --field-trial-handle=2712,i,13311033682700825640,7952161348430916764,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,7969172392714143299,6240736291804773816,2097152 --field-trial-handle=2712,i,13311033682700825640,7952161348430916764,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,5566137590413628116,14278877907327748240,2097152 --field-trial-handle=2712,i,13311033682700825640,7952161348430916764,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,12769174723722816435,7450994759002510099,2097152 --field-trial-handle=2712,i,13311033682700825640,7952161348430916764,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,9891433003659926218,10405596760499894087,2097152 --field-trial-handle=2712,i,13311033682700825640,7952161348430916764,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,462031566694181810,13500868407666015118,524288 --field-trial-handle=2712,i,13311033682700825640,7952161348430916764,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,6186980656303141617,14880392108056451554,524288 --field-trial-handle=2712,i,13311033682700825640,7952161348430916764,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,4632161102815154258,11300639523890694710,524288 --field-trial-handle=2712,i,13311033682700825640,7952161348430916764,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,4632161102815154258,11300639523890694710,524288 --field-trial-handle=2712,i,13311033682700825640,7952161348430916764,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,10734264126010395025,6044695384758270970,524288 --field-trial-handle=2712,i,13311033682700825640,7952161348430916764,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,12215861703957981811,5851992304369368309,524288 --field-trial-handle=2712,i,13311033682700825640,7952161348430916764,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,3822616746184436266,2757295087512969633,524288 --field-trial-handle=2712,i,13311033682700825640,7952161348430916764,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,906529275286433496,14923416198552274658,524288 --field-trial-handle=2712,i,13311033682700825640,7952161348430916764,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6200,i,11871672252898031159,12343363237815877332,262144 --field-trial-handle=2712,i,13311033682700825640,7952161348430916764,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,8270829785333655819,7453495282839926608,524288 --field-trial-handle=2712,i,13311033682700825640,7952161348430916764,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,1040137973610430544,7634843027303628850,524288 --field-trial-handle=2712,i,13311033682700825640,7952161348430916764,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,16107276350841192765,4545303315504522364,524288 --field-trial-handle=2712,i,13311033682700825640,7952161348430916764,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,13357544067803102923,17640673041154659804,524288 --field-trial-handle=2712,i,13311033682700825640,7952161348430916764,262144 --variations-seed-version --mojo-platform-channel-handle=1508 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3004,i,14640005246917600909,10302903776000632561,524288 --field-trial-handle=2712,i,13311033682700825640,7952161348430916764,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:8
  2⤵
  PID:3636

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b8c96d0c-fe26-4718-b099-9fd967359f91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\b8c96d0c-fe26-4718-b099-9fd967359f91.tmp
Size 105KB
SHA256 c49caaa6105f1f4ebe38e0e53c0330fc215dbd571c3457bfbbda3c72b3c53493
MD5 9cae2df7cfe3c96e9afaea3efff423b6
SHA1 43c01b2c4edbe548db4a9710a524b8be97e38723
SHA512 fd862c8bbb7ba48f684357c5500efad7c68cb414e5d0ca77dd46cb130573487033dd34929fcc6dff1fc4f6880da04d9c365e1a145d3ee329448452e4c14ab746
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7c:fwUQC5VwBIiElEd2K57P7c
TLSH
T11CB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 dcaa33843893153c209045c2d4ae1b8f0ad76625d67f668a21f22be6eeaf51de
MD5 6775ed810ae25fc97ab689ecd2c34cb0
SHA1 9c81c4a4fdcab0a0c3809648b56600320bfd9bc5
SHA512 0c81f2fe8938d7d096888bceb7db370d2c11788834feb7d1c7314ed045b5c7d3b7be0097c604925e6e5b02c4f612adc94a63c5dab2021797bb4271f537499260
SSDEEP 192:JjzmT/////////////////////////////MxLO:JjzmT//////////////////////////5
TLSH
T10AE1314242D9DBDEDF05508B4A54529C40B0374BEBDCEE0817DCCEDD348E8DAE9A3694
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 372b6bc5c3861098fdb6204d5d824595a643221dbd27f5f8e7150eb5439ddfbd
MD5 34ad720f94f81c331b6caa4579840de4
SHA1 8b8304bdafa8960425653ce3b48a5833ecf71d7d
SHA512 3702953b0067c454dd357b2c1b45c2928611705375243e6db5bb9ed36c52333b04cfe43c5378ab8d19fe7bf1e04b89a0cb037eeb982f51789c5173924c312f89
SSDEEP 192:XjYZs66666666666666666666666UUUUUUM0LO:XjYZs66666666666666666666666UUUt
TLSH
T1E1E1404283D4DADECF1661C78A60935C51707B4AEBDCE50803CCCEDD354E89BF9AA694
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 15b1bc7232af31da8d2b36f3217aa91dbbaed84def3a451d8ac35713fa91e321
MD5 d330aa1f8a680495c4d809e0c65c0e0f
SHA1 a381e88e844ab03c5ccf8bdbb228efe52365873e
SHA512 bd8901b0089125427fba2b40df79b6c053c18bb35a019d4c2aa720e70d12ffd48795564bcbfa2b97fbcd45f2c1bb29faeb8cb083959959d95b1eaffacbbbcdcb
TLSH
T11871A7770172446AEFF38DB267C10B89B03686E4F59B3E7E506C74B65A183A3811505F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59260c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59260c.TMP
Size 3KB
SHA256 6bf2e911f0387e6d442f36648c8a9c74097ba537e6307ca567715d7ac2b3ea48
MD5 832b66b3923b465619a811327bd01792
SHA1 9bf0fc5826374f142d76b286b90058f9769b7ee6
SHA512 b042b51cf007ea5a84b24c2c48a3604780c60b6339cd1a2a35325bb819cb0ab41c889ef5d5c9bb4137c2b1173f2956acf1bd845657c9837ed029f8a436ee17f8
TLSH
T14771C6770172406AEFF38DB267C10B89B0368AE4F59B3E7E506C74B25A183A3811905F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d9073ea790d66f517f990e44c50c56ee9f22b94ad8ee185ccf46ff8688e4786a
MD5 e4ea8da84743d9ac06575e9303f1d783
SHA1 f65f93fe7d1381c70dc5949fe29fdef661623f30
SHA512 89ad1dc9763234c2c358caf7981ab430e27cddc400776fc128961ad3dd4ece08668e820eeff8b6bdb3260feb785b14e359b8ef73f422a7e93df3efe2964daaaa
TLSH
T1B511C0F383E1956E8E0156F05A18AF1BCE1D0616821C3D1AC9E4EF2BC3E3075E00165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0e7616c7610d45e7eb8196cb4018a147d070cedbc08ecc3b0e2ce4b0ed345b32
MD5 7580a277a31e0dbc273a408970c85830
SHA1 9b311b4a3d10e36a37baa53513b79caf8e7cc4eb
SHA512 4dd48c4688431b54347272840e3b3ff01062f8ee6229f06958c245e9db938cdf145fb601cab1dab310c545a73eabaf61be34fcdc67aff3d51c90480914e9e5b0
TLSH
T145115BF383E1956E8A1556F09A28AF2BDE1D0516821C7D69C5D4EF27D3E3071E002A6B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 36f029948c87f4a4eda9d75fc87834f54698c5a1316a09432a2d4ebfe0fd5c2d
MD5 1b595e5a7d37e086bbf27e1ce35ba757
SHA1 00976ad36b39006f1e89fbd5eae92ec73cca3555
SHA512 8e8df3a7decfcee9f18529abf10be503b07d92a8e93ab721ac46334da57b3f8fac677c32e5ae9185cc60fa2a4a1f690caf4c6432a6b14716d2f50be182adbff9
SSDEEP 192:sxZyRFyM/jK1Ml8UQskP/f/sTflAOVZIdptWHW6+WNTNL/YvAHGtucIg5SLJ:sxZyTq3P/f/szlALcHbh/fILC
TLSH
T11F52F8126A346977CCDBE20AFA41BF53D6F5153392900E84A9FCCA1C05E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3948d03370845a7a21a73a71be1cb9824fca013d11e99f71d28d435edc8bb6fe
MD5 56be2fb663da403963547460045f68f0
SHA1 2183d107ae2aa338b6ddf3a2c9bc9f1687fac8b4
SHA512 70b16c16f644dbe8b555191e3733b0d773300a68da4dbcbb74aa4db6075dd3c478217933840d96e3d6d5afb8f1de6115bae63314364d8e53ae28e48a0db875f6
SSDEEP 192:sxZyRFyM/jK1Ml8MkP/f/sJl2OVZIdpvWHW6+WNTNL/YvE7YucIgrJ:sxZyTMP/f/sJl2LeHbh/OL9
TLSH
T16752E8116A346977CCDBE209FA41BB53D6F91533A2940E84ADFCCA1C05E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e160523edd92997c4168739571d4fb1a2d6acd67c54a061ab705a9eb99baa3fd
MD5 9b85b3d7fba8eb1fb2b3a5a4f87db4d4
SHA1 20a504a5d978dd7353b5babc0bdfa93903d9656f
SHA512 218c78d5bbcbc4a05d810a747ed7f63cc7b027f2ecc29c6c94ce0dfa2a82e2f123ad1573a03a784331c9674a45f056c70444bf7a73732d06c541e61c055e3e97
SSDEEP 768:aEseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppxroSS:aEseJ3xWvhfynu1jaVcL88pKf
TLSH
T126D20B2B280CCB7E4F844E5DEC266F966EE801CB57984D5487EA884C03C77EB512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\temp-index
Size 2KB
SHA256 896026745014a902b8dc468fb4ba40dec27456207f4d4de80ed1e9a925c44375
MD5 913b9572752b5a3c8b4badc822aad0f1
SHA1 849567f2bc93aae059c82fa35cb52b2d6a70b540
SHA512 a62d97b5fd1b482760502cf572c0aeb60f6249cba17cd73bbece3005cc98be121044d9b5e17ff90b509a8c86c0d035e3f1b6bbdb274a4499c3d6323416f81e01
TLSH
T19D41C94E8D40856FCC6845B204B264E43374DCDC1B4192574CBC2A3A7C57B791D0B5AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d6da1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5d6da1.TMP
Size 2KB
SHA256 dc057622f3619ae6643138e18fed82f1fc3fb467da5e15a0716b21b81aa75600
MD5 cfa6d5b33869e4226de9d3907fe01016
SHA1 ea6b75b7d2a760bc8f156af05f3ff64c8bf55172
SHA512 b22dd79e9edbf52acec56eea16a4df1444433a47804c6d95932fbcaad8531c9a2781c7190c26ce3c22883ade4c0923343b34252652b180bce0d9e5762fa040f9
TLSH
T11641868B4E42861FD8D044B30A93B4A83339D84097567B47A4FC573AB8A17BD2D9F1D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 1c422b2fa8cbe7d113c18168d183f3f57a74bb90fa0ea99450668afd528e1868
MD5 6ea79230c6453301f0ee39be8448c183
SHA1 0f0a84996b51083edff3aad8f1be53ecea96de14
SHA512 842936326c563ab08cd8bdda79f6351401f44f796a929e3a811c642c400373205a7d059e720f6f1c39d941a8b68e44c0ce0730c38d8cc160c0e967af52431422
TLSH
T1AEE0C0762DD72450BEAFC3D120308090060A749DE945FC0E641BF6C310B231534D7C35
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 a47a5d1693885591d7f7b771fd4c592450c286887bf93ac607bc01e89a2272d3
MD5 00fc248889c9332a59cb1fc7c1caf208
SHA1 b6c8e532c74e63c34b412f0c43bdd27baf09b5e0
SHA512 0b7bd88715e3afb142f8d0ef6e8f63b7b702d2c5cc2aead7fc5b8bf19280bb94708f21793cc986c7b3212cc623faecc170f1af2e93e9635989b4b00e0345fb4a
SSDEEP 96:KYH+Kggmq+YKXKAO72K4ET2sKvKC6IwKpyp:49Hx5P3PS
TLSH
T12BE15A07303A0652387EAE88B3A696374F8135633118A8AF7FB855594D2EE114DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5df10e3e-1a7f-4772-9c5d-b69f34da1173.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5df10e3e-1a7f-4772-9c5d-b69f34da1173.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 348b2bcaa2de4d6020849784133efe71bb21dfc08a274d1f852643ee79334605
MD5 ba365c8ab7bd1d3a413a56a54cb1fef1
SHA1 a8aa0a11fe3374806f4720864d4cedd6c72bee53
SHA512 924c8109bc5804f6080d764d6fe3aa15b06b513a9be3f41ad6ffd132c0fe2a56434f9bfb05586e6ba78e53f1d35a47d0d0749ad44bf84ecd51e30cedc756b7f2
SSDEEP 384:aiFiZcIBsNK8TUNTUlIlNW7PAMo+dUxcuD1t6GT:RFQBfwgy5dM0GT
TLSH
T150B22CF248D7843AD9AE6743E77D2E024EBCC167B5845A50B7D89A1CCD961BFC306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 15558ce017fd168e2ac3d82d0a40b516b978c1149d4181eaec849842ef41ed70
MD5 04422443de5087a299ce0c41e2b7ae7f
SHA1 c6062464963c36d719fb9619de787d41e5c839b2
SHA512 debdda1ec02c592a736a1955c2ecfda23e444d6c43edafb37336bc4dda214bc31f3af44bc017f97e995152b1ce0ebf729d92d257f94c889959fa3e5a28b957cf
SSDEEP 192:uQm+xasuheOwQxMGsNy8Qsq7OM7N5AQmiU1Dg34MTcB+FdLIxfUutlu8z1kqT1cU:MZcIhsNy8W7PAOo+dUxcuDvt6GT
TLSH
T169626D716C749C37A9A3B542F48A37075FF49227E6C46F94E9EDEF1D01D92AC030A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 0ebb80c09d9b163f7fbedb4142a46e4d8b33d6bf28ac0511c7df4d29c36a4fa3
MD5 e02aa466ec361ab161f948b46d8cdbfc
SHA1 7d7e89db9f16be58d552de9ca18fc9edf1978450
SHA512 c9102b11ccbc29d331b8549ce3a3d28b4928eeba61d78702f263693ffc571a660b4d1b4329a820f9b97d8ea5ee4a87aa231802da24ff4efb91a08a72b5166131
SSDEEP 192:uAm+xasuheOwQxMGsNyNQsq7OM7N5AQmiU1Dg34MTcB+FdLIxfUutlu8z1kqT1cU:8ZcIhsNyNW7PAOo+dUxcuDvt6GT
TLSH
T1AC626C716C749C37A9A3B542F48A37075FF4922BA6C46F94EAEDEF1D01D926C030B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c2bf090f92de4acd895196d9a0874b2403855d82bad3b0b7794bb8a30b39e6c1
MD5 329f5caf7a254cdafddd2d4547015800
SHA1 db751fcc672fd3c01b406ead92d379dbbd728c36
SHA512 6f1ef810728b10feb33d963d0cd6ceb460a932b47b279539574b3d25c598e87e918d49e61b61c33872d09088037864f04f6ac9ae1096f3c35375e0f31f09f71c
SSDEEP 192:lOND6vMtPQmiUyX0ThTcB+FdLIxP847HEPU/u:lOND6UtRrTldUxXkPU/u
TLSH
T156020A35BC786C7BEAA3BD46F48A37171FE4616BA5D01B54EAE82F1C00D764C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 726a8465a47dc326fdbd12eb43929f30d7a22715ce06a6dd655e1bc0c839a517
MD5 e3b6127f21ee11ef04964d2371840228
SHA1 45359160503f7c29bdef3d71d5f00e626fef3c06
SHA512 986dfb048f5a84be780863d33302e0a21b56d56c7250b0bddac58cf8986a7d61c927a7f5a1aae0e291df3ab323723b48c8e8ace5f254f143140154875f314b6a
SSDEEP 192:9ONz6vMLPQmiUy80YhTcB+FdLIxfUutlc80IkqT1cU/u:9ONz6ULRqYldUxcuDht6U/u
TLSH
T1AA121A35A8749C2BAE93B546F08A33175FA0932BEAC46F50FADC6F1C01DE65C130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2e1c10aae6e7ded870ffbc04842b77a431ce46455ecf3f1dc93ccc41bed81641
MD5 01e22cf0dc049079b5909b35807efa78
SHA1 4dbe8a58587c5d86a4d18820447d786bef71f8a9
SHA512 25a4843a7e097c9f3ed928b7b70eeef000a7671fb87bd461e02569c439ea9194d533f8b8255a88abcf5ea5c964546b675f7d7a346427633e905742daf0a971b7
TLSH
T17A41E558A6E91148B3B76F569BF6A8AE447F7D732B0BD45D00010E8F0A62B00C861733
MD5 SHA1 SHA512 TLSH

Submit Download